http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8944 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8944 IBM AIX allows a local user to open a file with a specially crafted argument that would crash the system.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0266 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0266 IBM AIX 5.3, 6.1, 7.1, and 7.2 and VIOS 2.2.x do not default to the latest TLS version, which makes it easier for man-in-the-middle attackers to obtain sensitive information via unspecified vectors.

The remote AIX host has a version of OpenSSH installed that is affected by the following vulnerabilities :

  - An elevation of privilege vulnerability exists in the     do_setup_env() function within file session.c when     handling user-supplied environmental variables. A local     attacker can exploit this to gain elevated privileges by     triggering a crafted environment for the /bin/login     program. This vulnerability requires that the UseLogin     feature is enabled and that PAM is configured to read     .pam_environment files in user home directories.
    (CVE-2015-8325)

  - A flaw exists when handling authentication requests that     involve overly long passwords due to returning shorter     response times for requests for invalid users than for     valid users. An unauthenticated, remote attacker can     exploit this to enumerate valid usernames by conducting     a timing attack. (CVE-2016-6210)

  - A denial of service vulnerability exists in the     auth_password() function within auth-passwd.c due to a     a failure to limit password lengths. An unauthenticated,     remote attacker can exploit this, via overly long     passwords, to cause the excessive consumption of CPU     resources. (CVE-2016-6515)

The version of OpenSSL installed on the remote AIX host is affected by the following vulnerabilities :

  - Multiple integer overflow conditions exist in s3_srvr.c,     ssl_sess.c, and t1_lib.c due to improper use of pointer     arithmetic for heap-buffer boundary checks. An     unauthenticated, remote attacker can exploit this to     cause a denial of service. (CVE-2016-2177)

  - An information disclosure vulnerability exists in the     dsa_sign_setup() function in dsa_ossl.c due to a failure     to properly ensure the use of constant-time operations.
    An unauthenticated, remote attacker can exploit this,     via a timing side-channel attack, to disclose DSA key     information. (CVE-2016-2178)

  - A denial of service vulnerability exists in the DTLS     implementation due to a failure to properly restrict the     lifetime of queue entries associated with unused     out-of-order messages. An unauthenticated, remote     attacker can exploit this, by maintaining multiple     crafted DTLS sessions simultaneously, to exhaust memory.
    (CVE-2016-2179)

  - An out-of-bounds read error exists in the X.509 Public     Key Infrastructure Time-Stamp Protocol (TSP)     implementation. An unauthenticated, remote attacker can     exploit this, via a crafted time-stamp file that is     mishandled by the 'openssl ts' command, to cause     denial of service or to disclose sensitive information.
    (CVE-2016-2180)

  - A denial of service vulnerability exists in the     Anti-Replay feature in the DTLS implementation due to     improper handling of epoch sequence numbers in records.
    An unauthenticated, remote attacker can exploit this,     via spoofed DTLS records, to cause legitimate packets to     be dropped. (CVE-2016-2181)

  - An overflow condition exists in the BN_bn2dec() function     in bn_print.c due to improper validation of     user-supplied input when handling BIGNUM values. An     unauthenticated, remote attacker can exploit this to     crash the process. (CVE-2016-2182)

  - A vulnerability exists, known as SWEET32, in the 3DES     and Blowfish algorithms due to the use of weak 64-bit     block ciphers by default. A man-in-the-middle attacker     who has sufficient resources can exploit this     vulnerability, via a 'birthday' attack, to detect a     collision that leaks the XOR between the fixed secret     and a known plaintext, allowing the disclosure of the     secret text, such as secure HTTPS cookies, and possibly     resulting in the hijacking of an authenticated session.
    (CVE-2016-2183)

  - A flaw exists in the tls_decrypt_ticket() function in     t1_lib.c due to improper handling of ticket HMAC     digests. An unauthenticated, remote attacker can exploit     this, via a ticket that is too short, to crash the     process, resulting in a denial of service.
    (CVE-2016-6302)

  - An integer overflow condition exists in the     MDC2_Update() function in mdc2dgst.c due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a heap-based     buffer overflow, resulting in a denial of service     condition or possibly the execution of arbitrary code.
    (CVE-2016-6303)

  - A flaw exists in the ssl_parse_clienthello_tlsext()     function in t1_lib.c due to improper handling of overly     large OCSP Status Request extensions from clients. An     unauthenticated, remote attacker can exploit this, via     large OCSP Status Request extensions, to exhaust memory     resources, resulting in a denial of service condition.
    (CVE-2016-6304)

  - An out-of-bounds read error exists in the certificate     parser that allows an unauthenticated, remote attacker     to cause a denial of service via crafted certificate     operations. (CVE-2016-6306)

  - A flaw exists in the GOST ciphersuites due to the use of     long-term keys to establish an encrypted connection. A     man-in-the-middle attacker can exploit this, via a Key     Compromise Impersonation (KCI) attack, to impersonate     the server.

  - A denial of service vulnerability exists in x509_vfy.c     due to improper handling of certificate revocation lists     (CRLs). An unauthenticated, remote attacker can exploit     this, via a specially crafted CRL, to cause a NULL     pointer dereference, resulting in a crash of the     service. (CVE-2016-7052)

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following subcomponents :

  - An unspecified flaw exists in the Networking     subcomponent that allows a local attacker to impact     integrity. (CVE-2016-3485)

  - An unspecified flaw exists in the Deployment     subcomponent that allows a local attacker to gain     elevated privileges. (CVE-2016-3511)

  - A flaw exists in the Libraries subcomponent in the     share/classes/java/lang/invoke/MethodHandles.java class     within the MethodHandles::dropArguments() function that     allows an unauthenticated, remote attacker to impact     confidentiality, integrity, and availability.
    (CVE-2016-3598)

The remote AIX host is running a version of IBM PowerHA SystemMirror that is missing a security patch. It is, therefore, affected by a privilege escalation vulnerability in the Cluster Single Point of Control (CSPOC) feature that occurs when adding an authenticated, remote user to the list that allows cluster-wide changing of the password. An authenticated, remote attacker who has been added to this list can exploit this issue, via a vulnerable script shipped with the product, to gain root privileges by using a 'su root' action.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6079 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6079 AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7575 The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message during a TLS handshake. An attacker could exploit this vulnerability using man-in-the-middle techniques to impersonate a TLS server and obtain credentials. IBM AIX does not require the newest version of TLS by default which could allow a remote attacker to obtain sensitive information using man in the middle techniques.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3053 IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges.

A directory traversal vulnerability in the Eclipse Help component shipped by Tivoli Lightweight Infrastructure (LWI) allows remote attackers to read arbitrary files via a crafted URL. This vulnerability affects IBM System Director Console for AIX (pconsole) and Web Based System Management Remote Client (WebSM Remote).

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0281 IBM AIX Adapter FC5899 / FC1763 with 'jumbo_frames' disabled could allow a remote attacker to send specially crafted packets that would crash the adapter.

The version of NTP installed on the remote AIX host is affected by the following vulnerabilities :

  - A flaw exists in the receive() function due to the use     of authenticated broadcast mode. A man-in-the-middle     attacker can exploit this to conduct a replay attack.
    (CVE-2015-7973)

  - A NULL pointer dereference flaw exists in ntp_request.c     that is triggered when handling ntpdc relist commands.
    A remote attacker can exploit this, via a specially     crafted request, to crash the service, resulting in a     denial of service condition. (CVE-2015-7977)

  - An unspecified flaw exists in authenticated broadcast     mode. A remote attacker can exploit this, via specially     crafted packets, to cause a denial of service condition.
    (CVE-2015-7979)

  - A flaw exists in ntpq and ntpdc that allows a remote     attacker to disclose sensitive information in     timestamps. (CVE-2015-8139)

  - A flaw exists in the ntpq protocol that is triggered     during the handling of an improper sequence of numbers.
    A man-in-the-middle attacker can exploit this to conduct     a replay attack. (CVE-2015-8140)

  - A flaw exists in the ntpq client that is triggered when     handling packets that cause a loop in the getresponse()     function. A remote attacker can exploit this to cause an     infinite loop, resulting in a denial of service     condition. (CVE-2015-8158)

The version of OpenSSL installed on the remote AIX host is affected by the following vulnerabilities :

  - A heap buffer overflow condition exists in the     EVP_EncodeUpdate() function within file     crypto/evp/encode.c that is triggered when handling     a large amount of input data. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition. (CVE-2016-2105)

  - A heap buffer overflow condition exists in the     EVP_EncryptUpdate() function within file     crypto/evp/evp_enc.c that is triggered when handling a     large amount of input data after a previous call occurs     to the same function with a partial block. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2016-2106)

  - A remote code execution vulnerability exists in the     ASN.1 encoder due to an underflow condition that occurs     when attempting to encode the value zero represented as     a negative integer. An unauthenticated, remote attacker     can exploit this to corrupt memory, resulting in the     execution of arbitrary code. (CVE-2016-2108)

  - Multiple unspecified flaws exist in the d2i BIO     functions when reading ASN.1 data from a BIO due to     invalid encoding causing a large allocation of memory.
    An unauthenticated, remote attacker can exploit these to     cause a denial of service condition through resource     exhaustion. (CVE-2016-2109)

  - An out-of-bounds read error exists in the     X509_NAME_oneline() function within file     crypto/x509/x509_obj.c when handling very long ASN1     strings. An unauthenticated, remote attacker can exploit     this to disclose the contents of stack memory.
    (CVE-2016-2176)

The remote host is missing AIX PTF U870384, which is related to the security of the package bos.net.tcp.bind_utils.

ISC BIND is vulnerable to a denial of service, caused by an error in db.c when parsing incoming responses. A remote attacker could exploit this vulnerability to trigger a REQUIRE assertion failure and cause a denial of service.

ISC BIND is vulnerable to a denial of service, caused by improper bounds checking in apl_42.c. By sending specially crafted Address Prefix List (APL) data, a remote authenticated attacker could exploit this vulnerability to trigger an INSIST assertion failure and cause the named process to terminate.

The remote host is missing AIX PTF U870330, which is related to the security of the package bos.rte.control.

Libxml2 is vulnerable to a denial of service, caused by a heap-based buffer overflow in the xmlParseEntityDecl or xmlParseConditionalSections function. By using a specially crafted XML data, a remote attacker could exploit this vulnerability to trigger an out-of-bounds read and cause the system to crash. Libxml2 is vulnerable to a denial of service, caused by a heap-based buffer overflow in the xmlParseConditionalSections function. By using a specially crafted XML data, a remote attacker could exploit this vulnerability to trigger an out-of-bounds read and cause the system to crash. libxml2 is vulnerable to a buffer overflow, caused by improper bounds checking by the XML parser in xmlNextChar. By using a malformed XML file, a local attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.

The remote host is missing AIX PTF U869149, which is related to the security of the package bos.net.tcp.client.

Network Time Protocol (NTP) is vulnerable to a denial of service, caused by an error in the sntp program. By sending specially crafted NTP packets, a remote attacker from within the local network could exploit this vulnerability to cause the application to enter into an infinite loop. Network Time Protocol (NTP) is vulnerable to a denial of service, caused by an error in ntp_crypto.c. An attacker could exploit this vulnerability using a packet containing an extension field with an invalid value for the length of its value field to cause ntpd to crash. Network Time Protocol (NTP) is vulnerable to a denial of service, caused by an error in ntp_crypto.c. An attacker could exploit this vulnerability using a packet containing an extension field with an invalid value for the length of its value field to cause ntpd to crash. Network Time Protocol (NTP) could allow a remote attacker to obtain sensitive information, caused by a memory leak in CRYPTO_ASSOC. An attacker could exploit this vulnerability to obtain sensitive information. Network Time Protocol (NTP) is vulnerable to a denial of service, caused by an error in ntp_crypto.c. An attacker could exploit this vulnerability using a packet containing an extension field with an invalid value for the length of its value field to cause ntpd to crash. Network Time Protocol (NTP) is vulnerable to a denial of service, caused by an error in the remote configuration functionality. By sending a specially crafted configuration file, an attacker could exploit this vulnerability to cause the application to enter into an infinite loop. Network Time Protocol (NTP) is vulnerable to a buffer overflow, caused by improper bounds checking by the refclock of ntpd. By sending an overly long string, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
Network Time Protocol (NTP) is vulnerable to a denial of service, caused by ASSERT botch instead of returning FAIL on some invalid values by the decodenetnum() function. An attacker could exploit this vulnerability to cause a denial of service.

ISC BIND is vulnerable to a denial of service, caused by an error in db.c when parsing incoming responses. A remote attacker could exploit this vulnerability to trigger a REQUIRE assertion failure and cause a denial of service.

ISC BIND is vulnerable to a denial of service, caused by improper bounds checking in apl_42.c. By sending specially crafted Address Prefix List (APL) data, a remote authenticated attacker could exploit this vulnerability to trigger an INSIST assertion failure and cause the named process to terminate.

The remote host is missing AIX PTF U868958, which is related to the security of the package bos.net.tcp.client.

Network Time Protocol (NTP) is vulnerable to a denial of service, caused by an error in the sntp program. By sending specially crafted NTP packets, a remote attacker from within the local network could exploit this vulnerability to cause the application to enter into an infinite loop. Network Time Protocol (NTP) is vulnerable to a denial of service, caused by an error in ntp_crypto.c. An attacker could exploit this vulnerability using a packet containing an extension field with an invalid value for the length of its value field to cause ntpd to crash. Network Time Protocol (NTP) is vulnerable to a denial of service, caused by an error in ntp_crypto.c. An attacker could exploit this vulnerability using a packet containing an extension field with an invalid value for the length of its value field to cause ntpd to crash. Network Time Protocol (NTP) could allow a remote attacker to obtain sensitive information, caused by a memory leak in CRYPTO_ASSOC. An attacker could exploit this vulnerability to obtain sensitive information. Network Time Protocol (NTP) is vulnerable to a denial of service, caused by an error in ntp_crypto.c. An attacker could exploit this vulnerability using a packet containing an extension field with an invalid value for the length of its value field to cause ntpd to crash. Network Time Protocol (NTP) is vulnerable to a denial of service, caused by an error in the remote configuration functionality. By sending a specially crafted configuration file, an attacker could exploit this vulnerability to cause the application to enter into an infinite loop. Network Time Protocol (NTP) is vulnerable to a buffer overflow, caused by improper bounds checking by the refclock of ntpd. By sending an overly long string, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
Network Time Protocol (NTP) is vulnerable to a denial of service, caused by ASSERT botch instead of returning FAIL on some invalid values by the decodenetnum() function. An attacker could exploit this vulnerability to cause a denial of service.

ISC BIND is vulnerable to a denial of service, caused by an error in db.c when parsing incoming responses. A remote attacker could exploit this vulnerability to trigger a REQUIRE assertion failure and cause a denial of service.

ISC BIND is vulnerable to a denial of service, caused by improper bounds checking in apl_42.c. By sending specially crafted Address Prefix List (APL) data, a remote authenticated attacker could exploit this vulnerability to trigger an INSIST assertion failure and cause the named process to terminate.

The remote host is missing AIX PTF U868931, which is related to the security of the package bos.rte.control.

Libxml2 is vulnerable to a denial of service, caused by a heap-based buffer overflow in the xmlParseEntityDecl or xmlParseConditionalSections function. By using a specially crafted XML data, a remote attacker could exploit this vulnerability to trigger an out-of-bounds read and cause the system to crash. Libxml2 is vulnerable to a denial of service, caused by a heap-based buffer overflow in the xmlParseConditionalSections function. By using a specially crafted XML data, a remote attacker could exploit this vulnerability to trigger an out-of-bounds read and cause the system to crash. libxml2 is vulnerable to a buffer overflow, caused by improper bounds checking by the XML parser in xmlNextChar. By using a malformed XML file, a local attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.

The remote host is missing AIX PTF U866671, which is related to the security of the package bos.rte.control.

Libxml2 is vulnerable to a denial of service, caused by a heap-based buffer overflow in the xmlParseEntityDecl or xmlParseConditionalSections function. By using a specially crafted XML data, a remote attacker could exploit this vulnerability to trigger an out-of-bounds read and cause the system to crash. Libxml2 is vulnerable to a denial of service, caused by a heap-based buffer overflow in the xmlParseConditionalSections function. By using a specially crafted XML data, a remote attacker could exploit this vulnerability to trigger an out-of-bounds read and cause the system to crash. libxml2 is vulnerable to a buffer overflow, caused by improper bounds checking by the XML parser in xmlNextChar. By using a malformed XML file, a local attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.

ID	Name	Severity
96879	AIX 7.2 TL 0 : sysproc (IV91456)	medium
96878	AIX 7.2 TL 1 : sysproc (IV90234)	medium
95483	AIX 6.1 TL 9 : pconsole (IV89739)	low
95482	AIX 7.1 TL 4 : pconsole (IV89737)	low
95477	AIX OpenSSH Advisory : openssh_advisory9.asc	high
95255	AIX OpenSSL Advisory : openssl_advisory21.asc (SWEET32)	critical
94970	AIX Java Advisory : java_july2016_advisory.asc (July 2016 CPU)	critical
94674	AIX 6.1 / 7.1.2 / 7.1.3 : IBM PowerHA SystemMirror CSPOC Privilege Escalation	critical
94446	AIX 5.3 TL 12 : lquerylv (IV88658)	high
94445	AIX 7.1 TL 3 : lquerylv (IV88419)	high
94444	AIX 7.2 TL 0 : lquerylv (IV88053)	high
94443	AIX 6.1 TL 9 : lquerylv (IV87981)	high
94442	AIX 7.1 TL 4 : lquerylv (IV87640)	high
94181	AIX 5.3 TL 12 : nettcp (IV88960) (SLOTH)	medium
94180	AIX 5.3 TL 12 : nettcp (IV88959) (SLOTH)	medium
94178	AIX 7.1 TL 3 : nettcp (IV82412) (SLOTH)	medium
94176	AIX 7.1 TL 3 : nettcp (IV82330) (SLOTH)	medium
94175	AIX 7.1 TL 3 : nettcp (IV82328) (SLOTH)	medium
94174	AIX 7.1 TL 3 : nettcp (IV82327) (SLOTH)	medium
94173	AIX 6.1 TL 9 : nettcp (IV79072) (SLOTH)	medium
94171	AIX 6.1 TL 9 : nettcp (IV79070) (SLOTH)	medium
94170	AIX 6.1 TL 9 : nettcp (IV78625) (SLOTH)	medium
94169	AIX 6.1 TL 9 : nettcp (IV78624) (SLOTH)	medium
94099	AIX 7.1 TL 3 : lsmcode (IV88457)	high
94098	AIX 7.2 TL 0 : lsmcode (IV88042)	high
94097	AIX 7.1 TL 4 : lsmcode (IV88007)	high
94096	AIX 6.1 TL 9 : lsmcode (IV87794)	high
93822	AIX 6.1 TL 9 : pconsole (IV89418)	medium
93821	AIX 5.3 TL 12 : pconsole (IV89386)	medium
93820	AIX 7.1 TL 3 : pconsole (IV89385)	medium
92612	AIX 5.3 TL 12 : mustendd (IV84184)	low
92611	AIX 7.1 TL 3 : mustendd (IV82421)	low
92610	AIX 7.1 TL 4 : mustendd (IV81459)	low
92609	AIX 7.2 TL 0 : mustendd (IV81357)	low
92608	AIX 6.1 TL 9 : mustendd (IV80569)	low
92565	AIX 7.2 TL 0 : nettcp (IV86132) (SLOTH)	medium
92564	AIX 5.3 TL 12 : nettcp (IV86120) (SLOTH)	medium
92563	AIX 7.2 TL 0 : nettcp (IV86119) (SLOTH)	medium
92562	AIX 7.1 TL 4 : nettcp (IV86118) (SLOTH)	medium
92561	AIX 7.1 TL 3 : nettcp (IV86117) (SLOTH)	medium
92560	AIX 6.1 TL 9 : nettcp (IV86116) (SLOTH)	medium
92357	AIX NTP v4 Advisory : ntp_advisory6.asc (IV83983) (IV83992)	high
92356	AIX NTP v3 Advisory : ntp_advisory6.asc (IV83984) (IV83993) (IV83994) (IV83995) (IV84269)	high
92323	AIX OpenSSL Advisory : openssl_advisory20.asc	critical
91238	AIX 7.2 : bos.net.tcp.bind_utils (U870384)	high
91237	AIX 7.2 : bos.rte.control (U870330)	medium
91236	AIX 6.1 TL 9 : bos.net.tcp.client (U869149)	high
91235	AIX 7.1 TL 4 : bos.net.tcp.client (U868958)	high
91234	AIX 7.1 TL 4 : bos.rte.control (U868931)	medium
91233	AIX 6.1 TL 9 : bos.rte.control (U866671)	medium

Detections

Analytics

AIX Local Security Checks Family for Nessus

medium

medium

low

low

high

critical

critical

critical

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

high

high

medium

medium

medium

low

low

low

low

low

medium

medium

medium

medium

medium

medium

high

high

critical

high

medium

high

high

medium

medium