http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0266 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0266 IBM AIX 5.3, 6.1, 7.1, and 7.2 and VIOS 2.2.x do not default to the latest TLS version, which makes it easier for man-in-the-middle attackers to obtain sensitive information via unspecified vectors.

The version of NTP installed on the remote AIX host is affected by the following vulnerabilities :

  - A denial of service vulnerability exists in the     broadcast mode replay prevention functionality. An     unauthenticated, adjacent attacker can exploit this, via     specially crafted broadcast mode NTP packets     periodically injected into the broadcast domain, to     cause ntpd to reject broadcast mode packets from     legitimate NTP broadcast servers. (CVE-2016-7427)

  - A denial of service vulnerability exists in the     broadcast mode poll interval functionality. An     unauthenticated, adjacent attacker can exploit this, via     specially crafted broadcast mode NTP packets, to cause     ntpd to reject packets from a legitimate NTP broadcast     server. (CVE-2016-7428)

  - A flaw exists in the control mode (mode 6) functionality     when handling specially crafted control mode packets. An     unauthenticated, adjacent attacker can exploit this to     set or disable ntpd traps, resulting in the disclosure     of potentially sensitive information, disabling of     legitimate monitoring, or DDoS amplification.
    (CVE-2016-9310)

  - A NULL pointer dereference flaw exists in the     report_event() function within file ntpd/ntp_control.c     when the trap service handles certain peer events. An     unauthenticated, remote attacker can exploit this, via     a specially crafted packet, to cause a denial of service     condition. (CVE-2016-9311)

The version of NTP installed on the remote AIX host is affected by the following vulnerabilities :

  - A time serving flaw exists in the trusted key system     due to improper key checks. An authenticated, remote     attacker can exploit this to perform impersonation     attacks between authenticated peers. (CVE-2015-7974)

  - A denial of service vulnerability exists due to improper     handling of a crafted Crypto NAK Packet with a source     address spoofed to match that of an existing associated     peer. An unauthenticated, remote attacker can exploit     this to demobilize a client association. (CVE-2016-1547)

  - An information disclosure vulnerability exists in the     message authentication functionality in libntp that is     triggered during the handling of a series of specially     crafted messages. An adjacent attacker can exploit this     to partially recover the message digest key.
    (CVE-2016-1550)

  - A flaw exists due to improper filtering of IPv4 'bogon'     packets received from a network. An unauthenticated,     remote attacker can exploit this to spoof packets to     appear to come from a specific reference clock.
    (CVE-2016-1551)

  - A denial of service vulnerability exists that allows an     authenticated, remote attacker to manipulate the value     of the trustedkey, controlkey, or requestkey via a     crafted packet, preventing authentication with ntpd     until the daemon has been restarted. (CVE-2016-2517)

  - An out-of-bounds read error exists in the MATCH_ASSOC()     function that occurs during the creation of peer     associations with hmode greater than 7. An     authenticated, remote attacker can exploit this, via a     specially crafted packet, to cause a denial of service.
    (CVE-2016-2518)

  - An overflow condition exists in the ctl_getitem()     function in ntpd due to improper validation of     user-supplied input when reporting return values. An     authenticated, remote attacker can exploit this to cause     ntpd to abort. (CVE-2016-2519)

  - A denial of service vulnerability exists when handling     authentication due to improper packet timestamp checks.
    An unauthenticated, remote attacker can exploit this,     via a specially crafted and spoofed packet, to     demobilize the ephemeral associations. (CVE-2016-4953)

  - A flaw exists that is triggered when handling spoofed     packets. An unauthenticated, remote attacker can exploit     this, via specially crafted packets, to affect peer     variables (e.g., cause leap indications to be set). Note     that the attacker must be able to spoof packets with     correct origin timestamps from servers before expected     response packets arrive. (CVE-2016-4954)

  - A flaw exists that is triggered when handling spoofed     packets. An unauthenticated, remote attacker can exploit     this, via specially crafted packets, to reset autokey     associations. Note that the attacker must be able to     spoof packets with correct origin timestamps from     servers before expected response packets arrive.
    (CVE-2016-4955)

  - A denial of service vulnerability exists when handling     CRYPTO_NAK packets that allows an unauthenticated,     remote attacker to cause a crash. (CVE-2016-4957)

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following subcomponents :

  - An unspecified flaw exists in the Libraries subcomponent     that allows an unauthenticated, remote attacker to     impact integrity. (CVE-2016-5542)

  - An unspecified flaw exists in the JMX subcomponent that     allows an unauthenticated, remote attacker to impact     integrity. (CVE-2016-5554)

  - An unspecified flaw exists in the 2D subcomponent that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2016-5556)

  - An unspecified flaw exists in the AWT subcomponent that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2016-5568)

  - An unspecified flaw exists in the Networking     subcomponent that allows an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2016-5597)

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8944 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8944 IBM AIX allows a local user to open a file with a specially crafted argument that would crash the system.

The remote AIX host has a version of OpenSSH installed that is affected by the following vulnerabilities :

  - An elevation of privilege vulnerability exists in the     do_setup_env() function within file session.c when     handling user-supplied environmental variables. A local     attacker can exploit this to gain elevated privileges by     triggering a crafted environment for the /bin/login     program. This vulnerability requires that the UseLogin     feature is enabled and that PAM is configured to read     .pam_environment files in user home directories.
    (CVE-2015-8325)

  - A flaw exists when handling authentication requests that     involve overly long passwords due to returning shorter     response times for requests for invalid users than for     valid users. An unauthenticated, remote attacker can     exploit this to enumerate valid usernames by conducting     a timing attack. (CVE-2016-6210)

  - A denial of service vulnerability exists in the     auth_password() function within auth-passwd.c due to a     a failure to limit password lengths. An unauthenticated,     remote attacker can exploit this, via overly long     passwords, to cause the excessive consumption of CPU     resources. (CVE-2016-6515)

The version of OpenSSL installed on the remote AIX host is affected by the following vulnerabilities :

  - Multiple integer overflow conditions exist in s3_srvr.c,     ssl_sess.c, and t1_lib.c due to improper use of pointer     arithmetic for heap-buffer boundary checks. An     unauthenticated, remote attacker can exploit this to     cause a denial of service. (CVE-2016-2177)

  - An information disclosure vulnerability exists in the     dsa_sign_setup() function in dsa_ossl.c due to a failure     to properly ensure the use of constant-time operations.
    An unauthenticated, remote attacker can exploit this,     via a timing side-channel attack, to disclose DSA key     information. (CVE-2016-2178)

  - A denial of service vulnerability exists in the DTLS     implementation due to a failure to properly restrict the     lifetime of queue entries associated with unused     out-of-order messages. An unauthenticated, remote     attacker can exploit this, by maintaining multiple     crafted DTLS sessions simultaneously, to exhaust memory.
    (CVE-2016-2179)

  - An out-of-bounds read error exists in the X.509 Public     Key Infrastructure Time-Stamp Protocol (TSP)     implementation. An unauthenticated, remote attacker can     exploit this, via a crafted time-stamp file that is     mishandled by the 'openssl ts' command, to cause     denial of service or to disclose sensitive information.
    (CVE-2016-2180)

  - A denial of service vulnerability exists in the     Anti-Replay feature in the DTLS implementation due to     improper handling of epoch sequence numbers in records.
    An unauthenticated, remote attacker can exploit this,     via spoofed DTLS records, to cause legitimate packets to     be dropped. (CVE-2016-2181)

  - An overflow condition exists in the BN_bn2dec() function     in bn_print.c due to improper validation of     user-supplied input when handling BIGNUM values. An     unauthenticated, remote attacker can exploit this to     crash the process. (CVE-2016-2182)

  - A vulnerability exists, known as SWEET32, in the 3DES     and Blowfish algorithms due to the use of weak 64-bit     block ciphers by default. A man-in-the-middle attacker     who has sufficient resources can exploit this     vulnerability, via a 'birthday' attack, to detect a     collision that leaks the XOR between the fixed secret     and a known plaintext, allowing the disclosure of the     secret text, such as secure HTTPS cookies, and possibly     resulting in the hijacking of an authenticated session.
    (CVE-2016-2183)

  - A flaw exists in the tls_decrypt_ticket() function in     t1_lib.c due to improper handling of ticket HMAC     digests. An unauthenticated, remote attacker can exploit     this, via a ticket that is too short, to crash the     process, resulting in a denial of service.
    (CVE-2016-6302)

  - An integer overflow condition exists in the     MDC2_Update() function in mdc2dgst.c due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a heap-based     buffer overflow, resulting in a denial of service     condition or possibly the execution of arbitrary code.
    (CVE-2016-6303)

  - A flaw exists in the ssl_parse_clienthello_tlsext()     function in t1_lib.c due to improper handling of overly     large OCSP Status Request extensions from clients. An     unauthenticated, remote attacker can exploit this, via     large OCSP Status Request extensions, to exhaust memory     resources, resulting in a denial of service condition.
    (CVE-2016-6304)

  - An out-of-bounds read error exists in the certificate     parser that allows an unauthenticated, remote attacker     to cause a denial of service via crafted certificate     operations. (CVE-2016-6306)

  - A flaw exists in the GOST ciphersuites due to the use of     long-term keys to establish an encrypted connection. A     man-in-the-middle attacker can exploit this, via a Key     Compromise Impersonation (KCI) attack, to impersonate     the server.

  - A denial of service vulnerability exists in x509_vfy.c     due to improper handling of certificate revocation lists     (CRLs). An unauthenticated, remote attacker can exploit     this, via a specially crafted CRL, to cause a NULL     pointer dereference, resulting in a crash of the     service. (CVE-2016-7052)

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following subcomponents :

  - An unspecified flaw exists in the Networking     subcomponent that allows a local attacker to impact     integrity. (CVE-2016-3485)

  - An unspecified flaw exists in the Deployment     subcomponent that allows a local attacker to gain     elevated privileges. (CVE-2016-3511)

  - A flaw exists in the Libraries subcomponent in the     share/classes/java/lang/invoke/MethodHandles.java class     within the MethodHandles::dropArguments() function that     allows an unauthenticated, remote attacker to impact     confidentiality, integrity, and availability.
    (CVE-2016-3598)

The remote AIX host is running a version of IBM PowerHA SystemMirror that is missing a security patch. It is, therefore, affected by a privilege escalation vulnerability in the Cluster Single Point of Control (CSPOC) feature that occurs when adding an authenticated, remote user to the list that allows cluster-wide changing of the password. An authenticated, remote attacker who has been added to this list can exploit this issue, via a vulnerable script shipped with the product, to gain root privileges by using a 'su root' action.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6079 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6079 AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7575 The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message during a TLS handshake. An attacker could exploit this vulnerability using man-in-the-middle techniques to impersonate a TLS server and obtain credentials. IBM AIX does not require the newest version of TLS by default which could allow a remote attacker to obtain sensitive information using man in the middle techniques.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3053 IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges.

A directory traversal vulnerability in the Eclipse Help component shipped by Tivoli Lightweight Infrastructure (LWI) allows remote attackers to read arbitrary files via a crafted URL. This vulnerability affects IBM System Director Console for AIX (pconsole) and Web Based System Management Remote Client (WebSM Remote).

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0281 IBM AIX Adapter FC5899 / FC1763 with 'jumbo_frames' disabled could allow a remote attacker to send specially crafted packets that would crash the adapter.

ID	Name	Severity
100472	AIX 5.3 TL 12 : tcpdump (IV94729)	critical
100471	AIX 6.1 TL 9 : tcpdump (IV94728)	critical
100470	AIX 7.1 TL 3 : tcpdump (IV94727)	critical
100469	AIX 7.1 TL 4 : tcpdump (IV94726)	critical
100468	AIX 7.2 TL 0 : tcpdump (IV94724)	critical
100467	AIX 7.2 TL 1 : tcpdump (IV94723)	critical
99918	AIX 7.1 TL 3 : pconsole (IV93624)	low
99184	AIX NTP v4 Advisory : ntp_advisory8.asc (IV92126) (IV92287)	medium
99183	AIX NTP v4 Advisory : ntp_advisory7.asc (IV87278) (IV87279)	high
97051	AIX Java Advisory : java_oct2016_advisory.asc (October 2016 CPU)	critical
96881	AIX 7.1 TL 3 : sysproc (IV91488)	medium
96880	AIX 7.1 TL 4 : sysproc (IV91487)	medium
96879	AIX 7.2 TL 0 : sysproc (IV91456)	medium
96878	AIX 7.2 TL 1 : sysproc (IV90234)	medium
95483	AIX 6.1 TL 9 : pconsole (IV89739)	low
95482	AIX 7.1 TL 4 : pconsole (IV89737)	low
95477	AIX OpenSSH Advisory : openssh_advisory9.asc	high
95255	AIX OpenSSL Advisory : openssl_advisory21.asc (SWEET32)	critical
94970	AIX Java Advisory : java_july2016_advisory.asc (July 2016 CPU)	critical
94674	AIX 6.1 / 7.1.2 / 7.1.3 : IBM PowerHA SystemMirror CSPOC Privilege Escalation	critical
94446	AIX 5.3 TL 12 : lquerylv (IV88658)	high
94445	AIX 7.1 TL 3 : lquerylv (IV88419)	high
94444	AIX 7.2 TL 0 : lquerylv (IV88053)	high
94443	AIX 6.1 TL 9 : lquerylv (IV87981)	high
94442	AIX 7.1 TL 4 : lquerylv (IV87640)	high
94181	AIX 5.3 TL 12 : nettcp (IV88960) (SLOTH)	medium
94180	AIX 5.3 TL 12 : nettcp (IV88959) (SLOTH)	medium
94178	AIX 7.1 TL 3 : nettcp (IV82412) (SLOTH)	medium
94176	AIX 7.1 TL 3 : nettcp (IV82330) (SLOTH)	medium
94175	AIX 7.1 TL 3 : nettcp (IV82328) (SLOTH)	medium
94174	AIX 7.1 TL 3 : nettcp (IV82327) (SLOTH)	medium
94173	AIX 6.1 TL 9 : nettcp (IV79072) (SLOTH)	medium
94171	AIX 6.1 TL 9 : nettcp (IV79070) (SLOTH)	medium
94170	AIX 6.1 TL 9 : nettcp (IV78625) (SLOTH)	medium
94169	AIX 6.1 TL 9 : nettcp (IV78624) (SLOTH)	medium
94099	AIX 7.1 TL 3 : lsmcode (IV88457)	high
94098	AIX 7.2 TL 0 : lsmcode (IV88042)	high
94097	AIX 7.1 TL 4 : lsmcode (IV88007)	high
94096	AIX 6.1 TL 9 : lsmcode (IV87794)	high
93822	AIX 6.1 TL 9 : pconsole (IV89418)	medium
93821	AIX 5.3 TL 12 : pconsole (IV89386)	medium
93820	AIX 7.1 TL 3 : pconsole (IV89385)	medium
92612	AIX 5.3 TL 12 : mustendd (IV84184)	low
92611	AIX 7.1 TL 3 : mustendd (IV82421)	low
92610	AIX 7.1 TL 4 : mustendd (IV81459)	low
92609	AIX 7.2 TL 0 : mustendd (IV81357)	low
92608	AIX 6.1 TL 9 : mustendd (IV80569)	low
92565	AIX 7.2 TL 0 : nettcp (IV86132) (SLOTH)	medium
92564	AIX 5.3 TL 12 : nettcp (IV86120) (SLOTH)	medium
92563	AIX 7.2 TL 0 : nettcp (IV86119) (SLOTH)	medium

Detections

Analytics

AIX Local Security Checks Family for Nessus

critical

critical

critical

critical

critical

critical

low

medium

high

critical

medium

medium

medium

medium

low

low

high

critical

critical

critical

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

high

high

medium

medium

medium

low

low

low

low

low

medium

medium

medium