A man-in-the-middle (MitM) information disclosure vulnerability, known as POODLE, exists due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. A MitM attacker can decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections.

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities :

  - The Global Security Kit (GSKit) contains a flaw due to     improper restrictions of TLS state transitions. A     man-in-the-middle attacker can exploit this to downgrade     the security of a session to use EXPORT_RSA ciphers.
    This allows the attacker to more easily break the     encryption and monitor or tamper with the encrypted     stream. (CVE-2015-0138)

  - An unspecified flaw exists that allows an attacker to     execute code running under a security manager with     elevated privileges.(CVE-2015-0192)

  - A security feature bypass vulnerability, known as FREAK     (Factoring attack on RSA-EXPORT Keys), exists due to the     support of weak EXPORT_RSA cipher suites with keys less     than or equal to 512 bits. A man-in-the-middle attacker     may be able to downgrade the SSL/TLS connection to use     EXPORT_RSA cipher suites which can be factored in a     short amount of time, allowing the attacker to intercept     and decrypt the traffic. (CVE-2015-0204)

  - Multiple unspecified vulnerabilities exist in multiple     Java subcomponents including 2D, Beans, Deployment, JCE,     JSSE, and tools. (CVE-2015-0458, CVE-2015-0459,     CVE-2015-0469, CVE-2015-0477, CVE-2015-0478,     CVE-2015-0480, CVE-2015-0486, CVE-2015-0488,     CVE-2015-0491)

  - An unspecified flaw exists that allows a remote attacker     to bypass permission checks and gain access to sensitive     information. (CVE-2015-1914)

  - An unspecified flaw exists due to the Socket Extension     Provider's handling of TLS and SSL connections. A remote     attacker can exploit this to cause a denial of service.
    (CVE-2015-1916)

  - A security feature bypass vulnerability exists, known as     Bar Mitzvah, due to improper combination of state data     with key data by the RC4 cipher algorithm during the     initialization phase. A man-in-the-middle attacker can     exploit this, via a brute-force attack using LSB values,     to decrypt the traffic. (CVE-2015-2808)

The remote host is missing AIX PTF U865862, which is related to the security of the package bos.rte.lvm.

The running of lquerylv command with variable DBGCMD_LQUERYLV set may allow a local user to gain root privileges.

The remote host is missing AIX PTF U865854, which is related to the security of the package bos.rte.lvm.

The running of lquerylv command with variable DBGCMD_LQUERYLV set may allow a local user to gain root privileges.

The version of the Network Authentication Service (NAS) installed on the remote AIX host is affected by the following vulnerabilities related to Kerberos 5 :

  - Denial of service and remote code execution     vulnerabilities exist due to security context handles     not being properly maintained, allowing an     authenticated, remote attacker to crash the service or     execute arbitrary code using crafted GSSAPI traffic.
    (CVE-2014-5352)

  - A denial of service vulnerability exists due to improper     handling of zero-byte or unterminated strings.
    (CVE-2014-5355)

  - Denial of service and remote code execution     vulnerabilities exist which allow an authenticated,     remote attacker to crash the service or execute     arbitrary code using crafted, malformed XDR data.
    (CVE-2014-9421)

  - A privilege escalation vulnerability exists that allows     an authenticated, remote attacker to gain administrative     access via a flaw in kadmin authorization checks.
    (CVE-2014-9422)

  - An information disclosure vulnerability allows an     attacker to gain information about process heap memory     from NAS packets. (CVE-2014-9423)

The version of Java SDK installed on the remote host is affected by multiple vulnerabilities :

  - A man-in-the-middle information disclosure vulnerability     exists due to a TLS security downgrade flaw. A     man-in-the-middle attacker may be able to downgrade the     SSL/TLS connection to use EXPORT_RSA cipher suites which     can be factored in a short amount of time, allowing the     attacker to intercept and decrypt the traffic.
    (CVE-2015-0138)

  - A flaw exists in the RC4 algorithm implementation due to     improper combination of state data with key data during     the initialization phase. A man-in-the-middle attacker     can exploit this to conduct plaintext-recovery attacks.
    (CVE-2015-2808)

The version of OpenSSL installed on the remote AIX host is affected by the following vulnerabilities :

  - A use-after-free condition exists in the     d2i_ECPrivateKey() function due to improper processing     of malformed EC private key files during import. A     remote attacker can exploit this to dereference or free     already freed memory, resulting in a denial of service     or other unspecified impact. (CVE-2015-0209)

  - An invalid read flaw exists in the ASN1_TYPE_cmp()     function due to improperly performed boolean-type     comparisons. A remote attacker can exploit this, via a     crafted X.509 certificate to an endpoint that uses the     certificate-verification feature, to cause an invalid     read operation, resulting in a denial of service.
    (CVE-2015-0286)

  - A flaw exists in the ASN1_item_ex_d2i() function due to     a failure to reinitialize 'CHOICE' and 'ADB' data     structures when reusing a structure in ASN.1 parsing.
    This allows a remote attacker to cause an invalid write     operation and memory corruption, resulting in a denial     of service. (CVE-2015-0287)

  - A NULL pointer dereference flaw exists in the     X509_to_X509_REQ() function due to improper processing     of certificate keys. This allows a remote attacker, via     a crafted X.509 certificate, to cause a denial of     service. (CVE-2015-0288)

  - A NULL pointer dereference flaw exists in the PKCS#7     parsing code due to incorrect handling of missing outer     ContentInfo. This allows a remote attacker, using an     application that processes arbitrary PKCS#7 data and     providing malformed data with ASN.1 encoding, to cause     a denial of service. (CVE-2015-0289)

  - An integer underflow condition exists in the     EVP_DecodeUpdate() function due to improper validation     of base64 encoded input when decoding. This allows a     remote attacker, using maliciously crafted base64 data,     to cause a segmentation fault or memory corruption,     resulting in a denial of service or possibly the     execution of arbitrary code. (CVE-2015-0292)

  - A flaw exists in servers that both support SSLv2 and     enable export cipher suites due to improper     implementation of SSLv2. A remote attacker can exploit     this, via a crafted CLIENT-MASTER-KEY message, to cause     a denial of service. (CVE-2015-0293)

CVE-2014-8769 tcpdump is vulnerable to a denial of service, caused by the improper handling of input by the application decoder for the Ad hoc On-Demand Distance Vector (AODV) protocol. By sending specially-crafted data, a remote attacker could exploit this vulnerability to cause the application to crash.

Please see following for more information :

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8769

CVE-2014-8500 ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals. 

Please see following for more information :

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8500

The version of Java SDK installed on the remote host is affected by the following vulnerabilities :

  - A man-in-the-middle (MitM) information disclosure     vulnerability known as POODLE. The vulnerability is due     to the way SSL 3.0 handles padding bytes when decrypting     messages encrypted using block ciphers in cipher block     chaining (CBC) mode. MitM attackers can decrypt a     selected byte of a cipher text in as few as 256 tries if     they are able to force a victim application to     repeatedly send the same data over newly created SSL 3.0     connections. (CVE-2014-3566)

  - Information disclosure flaws exist in the font parsing     code in the 2D component in OpenJDK. A specially crafted     font file can exploit boundary check flaws and allow an     untrusted Java applet or application to disclose     portions of the Java Virtual Machine memory.
    (CVE-2014-6585, CVE-2014-6591)

  - A NULL pointer dereference flaw exists in the     MulticastSocket implementation in the Libraries     component of OpenJDK. An untrusted Java applet or     application can use this flaw to bypass certain     Java sandbox restrictions. (CVE-2014-6587)

  - The SSL/TLS implementation in the JSSE component in     OpenJDK fails to properly check whether the     ChangeCipherSpec was received during a SSL/TLS     connection handshake. An MitM attacker can use this     flaw to force a connection to be established without     encryption being enabled. (CVE-2014-6593)

  - An unspecified privilege escalation vulnerability exists     in IBM Java Virtual Machine. (CVE-2014-8891)

  - An unspecified information disclosure vulnerability     exists in the Libraries component of Oracle Java SE.
    (CVE-2015-0400)

  - An unspecified information disclosure vulnerability     exists in the Deployment component of Oracle Java SE.
    (CVE-2015-0403)

  - Unspecified denial of service and information     disclosure vulnerabilities exist in the Deployment     component of Oracle Java SE. (CVE-2015-0406)

  - An information disclosure vulnerability exists in the     Swing component in OpenJDK. An untrusted Java applet or     application can use this flaw to bypass certain Java     sandbox restrictions. (CVE-2015-0407)

  - Multiple improper permission check vulnerabilities exist     in the JAX-WS, Libraries, and RMI components in OpenJDK.
    An untrusted Java applet or application can use these     flaws to bypass Java sandbox restrictions.
    (CVE-2015-0412, CVE-2014-6549, CVE-2015-0408)

  - A denial of service vulnerability exists in the DER     (Distinguished Encoding Rules) decoder in the Security     component in OpenJDK when handling negative length     values. A specially crafted, DER-encoded input can cause     a Java application to enter an infinite loop when     decoded. (CVE-2015-0410)

The version of OpenSSL installed on the remote AIX host is affected by the following vulnerabilities :

  - The BIGNUM squaring (BN_sqr) implementation does not     properly calculate the square of a BIGNUM value. This     allows remote attackers to defeat cryptographic     protection mechanisms. (CVE-2014-3570)

  - A NULL pointer dereference flaw exists in the     dtls1_get_record() function when handling DTLS messages.
    A remote attacker, using a specially crafted DTLS     message, can cause a denial of service. (CVE-2014-3571)

  - A flaw exists with ECDH handshakes when using an ECDSA     certificate without a ServerKeyExchange message. This     allows a remote attacker to trigger a loss of forward     secrecy from the ciphersuite. (CVE-2014-3572)

  - A flaw exists when accepting non-DER variations of     certificate signature algorithms and signature encodings     due to a lack of enforcement of matches between signed     and unsigned portions. A remote attacker, by including     crafted data within a certificate's unsigned portion,     can bypass fingerprint-based certificate-blacklist     protection mechanisms. (CVE-2014-8275)

  - A security feature bypass vulnerability, known as FREAK     (Factoring attack on RSA-EXPORT Keys), exists due to the     support of weak EXPORT_RSA cipher suites with keys less     than or equal to 512 bits. A man-in-the-middle attacker     may be able to downgrade the SSL/TLS connection to use     EXPORT_RSA cipher suites which can be factored in a     short amount of time, allowing the attacker to intercept     and decrypt the traffic. (CVE-2015-0204)

  - A flaw exists when accepting DH certificates for client     authentication without the CertificateVerify message.
    This allows a remote attacker to authenticate to the     service without a private key. (CVE-2015-0205)

  - A memory leak occurs in dtls1_buffer_record when     handling a saturation of DTLS records containing the     same number sequence but for the next epoch. This allows     a remote attacker to cause a denial of service.
    (CVE-2015-0206)

The version of NTP installed on the remote AIX host is affected by the following vulnerabilities :

  - A security weakness exists due to the config_auth()     function improperly generating default keys when no     authentication key is defined in the ntp.conf file.
    Key size is limited to 31 bits and the insecure     ntp_random() function is used, resulting in     cryptographically-weak keys with insufficient entropy. A     remote attacker can exploit this to defeat cryptographic     protection mechanisms via a brute-force attack.
    (CVE-2014-9293)

  - A security weakness exists due the use of a weak seed to     prepare a random number generator used to generate     symmetric keys. This allows a remote attacker to defeat     cryptographic protection mechanisms via a brute-force     attack. (CVE-2014-9294)

  - Multiple stack-based buffer overflow conditions exist     due to improper validation of user-supplied input when     handling packets in the crypto_recv(), ctl_putdata(),     and configure() functions when using autokey     authentication. A remote attacker can exploit this, via     a specially crafted packet, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2014-9295)

CVE-2014-9293 If no authentication key is defined in the ntp.conf file, a cryptographically-weak default key is generated.

CVE-2014-9294 ntp-keygen before 4.2.7p230 uses a non-cryptographic random number generator with a weak seed to generate symmetric keys.

CVE-2014-9295 A remote unauthenticated attacker may craft special packets that trigger buffer overflow.

The running of lquerylv command with variable DBGCMD_LQUERYLV set may allow a local user to gain root privileges.

The version of the Network Authentication Service (NAS) installed on the remote AIX host is affected by a vulnerability related to Kerberos 5 which allows authenticated users to retrieve current keys, which can be used to forge tickets.

The remote host is missing AIX PTF U867348, which is related to the security of the package X11.base.lib.

The remote host is missing AIX PTF U865341, which is related to the security of the package X11.base.lib.

The version of rsyslog installed on the remote AIX host is affected by a remote code execution or denial of service vulnerability :

  - The installed rsyslog allows remote attackers to cause a     denial of service (crash), possibly execute arbitrary     code, or have other unspecified impacts by crafting a     priority (PRI) value that triggers an out-of-bounds     array access. (CVE-2014-3634)

  - The original fix for the above issue still retained a     denial of service vulnerability when large PRI values     were encountered. (CVE-2014-3683)

The version of Java SDK installed on the remote host is affected by the following vulnerabilities :

  - A privilege escalation vulnerability in the IBM Java SDK     allows a local attacker to inject arbitrary code into     the shared classes cache due to a flaw in the default     configuration for the shared classes feature. Other     users are able to execute the injected code, which can     allow the attacker to gain elevated privileges.
    (CVE-2014-3065)

  - Oracle Java contains the flaw related to SSLv3 CBC-mode     ciphers known as POODLE. The vulnerability is due to the     way SSL 3.0 handles padding bytes when decrypting     messages encrypted using block ciphers in cipher block     chaining (CBC) mode. A man-in-the-middle attacker can     decrypt a selected byte of a cipher text in as few as     256 tries if they are able to force a victim application     to repeatedly send the same data over newly created SSL     3.0 connections. (CVE-2014-3566)

  - Vulnerabilities in Oracle Java allow remote code     execution via flaws in the Deployment subcomponent.
    (CVE-2014-4288, CVE-2014-6492, CVE-2014-6493,     CVE-2014-6503, CVE-2014-6532)

  - A session hijacking vulnerability exists in Oracle Java     due to a flaw related to handling of server certificate     changes during SSL/TLS renegotiation. This allows an     attacker to intercept communication between a client and     server to hijack a mutually authenticated session.
    (CVE-2014-6457)

  - Privilege escalation vulnerabilities exist in Oracle     Java within the the Deployment subcomponent.
    (CVE-2014-6458, CVE-2014-6466)

  - Data integrity vulnerabilities exist in Oracle Java     within the the Deployment subcomponent. (CVE-2014-6476,     CVE-2014-6515, CVE-2014-6527)

  - A privilege escalation vulnerability exists in Oracle     Java in the resource bundle handling code of the     'LogRecord::readObject' function within the file     'share/classes/java/util/logging/LogRecord.java',     which allows an attacker to bypass certain sandbox     restrictions. (CVE-2014-6502)

  - A privilege escalation vulnerability exists in Oracle     Java within the property processing and name handling     code of 'share/classes/java/util/ResourceBundle.java',     which allows an attacker to bypass certain sandbox     restrictions. (CVE-2014-6506)

  - Oracle Java contains an unspecified vulnerability in the     2D subcomponent. (CVE-2014-6511)

  - An information disclosure vulnerability exists in Oracle     Java due to a flaw related to the wrapping of datagram     sockets in the DatagramSocket implementation. This issue     may cause packets to be read that originate from other     sources than the connected, thus allowing a remote     attacker to carry out IP spoofing. (CVE-2014-6512)

  - A flaw exists in the way splash images are handled by     'windows/native/sun/awt/splashscreen/splashscreen_sys.c'     which allows remote code execution. (CVE-2014-6513)

  - A privilege escalation vulnerability exists in Oracle     Java in 'share/classes/java/util/logging/Logger.java'     because it fails to check permissions in certain cases,     allowing an attacker to bypass sandbox restrictions and     view or edit logs. (CVE-2014-6531)

  - A flaw related to input cipher streams within the file     'share/classes/javax/crypto/CipherInputStream.java' can     allow a remote attacker to affect the data integrity.
    (CVE-2014-6558)

The remote host is missing AIX PTF U862099, which is related to the security of the package bos.rte.control.

Libxml2 is vulnerable to a denial of service, caused by the expansion of internal entities within the xmlParserHandlePEReference().

The remote host is missing AIX PTF U861276, which is related to the security of the package bos.rte.control.

Libxml2 is vulnerable to a denial of service, caused by the expansion of internal entities within the xmlParserHandlePEReference().

The version of OpenSSL installed on the remote host is affected by the following vulnerabilities :

  - An error exists related to DTLS SRTP extension handling     and specially crafted handshake messages that can allow     denial of service attacks via memory leaks.
    (CVE-2014-3513)

  - A man-in-the-middle (MitM) information disclosure     vulnerability known as POODLE. The vulnerability is due     to the way SSL 3.0 handles padding bytes when decrypting     messages encrypted using block ciphers in cipher block     chaining (CBC) mode. MitM attackers can decrypt a     selected byte of a cipher text in as few as 256 tries if     they are able to force a victim application to     repeatedly send the same data over newly created SSL 3.0     connections. (CVE-2014-3566)

  - An error exists related to session ticket handling that     can allow denial of service attacks via memory leaks.
    (CVE-2014-3567)

The version of OpenSSL installed on the remote host is affected by the following vulnerabilities :

  - A memory double-free error exists related to handling     DTLS packets that allows denial of service attacks.
    (CVE-2014-3505)

  - An unspecified error exists related to handling DTLS     handshake messages that allows denial of service attacks     due to large amounts of memory being consumed.
    (CVE-2014-3506)

  - A memory leak error exists related to handling     specially crafted DTLS packets that allows denial of     service attacks. (CVE-2014-3507)

  - An error exists related to 'OBJ_obj2txt' and the pretty     printing 'X509_name_*' functions which leak stack data,     resulting in an information disclosure. (CVE-2014-3508)

  - An error exists related to 'ec point format extension'     handling and multithreaded clients that allows freed     memory to be overwritten during a resumed session.
    (CVE-2014-3509)

  - A NULL pointer dereference error exists related to     handling anonymous ECDH cipher suites and crafted     handshake messages that allow denial of service attacks     against clients. (CVE-2014-3510)

  - An error exists related to handling fragmented     'ClientHello' messages that could allow a     man-in-the-middle attacker to force usage of TLS 1.0     regardless of higher protocol levels being supported by     both the server and the client. (CVE-2014-3511)

  - A buffer overflow error exists related to handling     Secure Remote Password protocol (SRP) parameters having     unspecified impact. (CVE-2014-3512)

  - A NULL pointer dereference error exists related to     handling Secure Remote Password protocol (SRP) that     allows a malicious server to crash a client, resulting     in a denial of service. (CVE-2014-5139)

The version of the Network Authentication Service (NAS) installed on the remote AIX host is affected by the following vulnerabilities related to Kerberos 5 :

  - An attacker can cause a denial of service (buffer     over-read and application crash) by injecting invalid     tokens into a GSSAPI application session.
    (CVE-2014-4341)

  - An attacker with the ability to spoof packets appearing     to be from a GSSAPI acceptor can cause a denial of     service or execute arbitrary code by using a double-free     condition in GSSAPI initiators (clients) which are using     the SPNEGO mechanism, by returning a different     underlying mechanism than was proposed by the initiator.
    (CVE-2014-4343)

  - An attacker can cause a denial of service through a NULL     pointer dereference and application crash during a     SPNEGO negotiation, by sending an empty token as the     second or later context token from initiator to     acceptor. (CVE-2014-4344)

The remote host is missing AIX PTF U865807, which is related to the security of the package bos.rte.odm.

AIX could allow a arbitrary file overwrite symlink vulnerability due to libodm.a bug.

ID	Name	Severity
84275	AIX 6.1 TL 9 : nettcp (IV73976) (POODLE)	medium
84274	AIX 7.1 TL 3 : nettcp (IV73975) (POODLE)	medium
84273	AIX 7.1 TL 2 : nettcp (IV73974) (POODLE)	medium
84272	AIX 6.1 TL 8 : nettcp (IV73973) (POODLE)	medium
84271	AIX 7.1 TL 3 : nettcp (IV73419) (POODLE)	medium
84270	AIX 7.1 TL 2 : nettcp (IV73418) (POODLE)	medium
84269	AIX 6.1 TL 9 : nettcp (IV73417) (POODLE)	medium
84268	AIX 6.1 TL 8 : nettcp (IV73416) (POODLE)	medium
84267	AIX 6.1 TL 9 : nettcp (IV73324) (POODLE)	medium
84266	AIX 7.1 TL 2 : nettcp (IV73319) (POODLE)	medium
84265	AIX 7.1 TL 3 : nettcp (IV73316) (POODLE)	medium
84264	AIX 6.1 TL 8 : nettcp (IV69768) (POODLE)	medium
84087	AIX Java Advisory : java_april2015_advisory.asc (Bar Mitzvah) (FREAK)	critical
83879	AIX 6.1 TL 9 : bos.rte.lvm (U865862)	high
83878	AIX 7.1 TL 3 : bos.rte.lvm (U865854)	high
83874	AIX NAS Advisory : nas_advisory3.asc	high
83135	AIX Java Advisory : Multiple Vulnerabilities (Bar Mitzvah)	medium
82900	AIX OpenSSL Advisory : openssl_advisory13.asc	high
81923	AIX 6.1 TL 9 : tcpdump (IV68992)	medium
81922	AIX 7.1 TL 2 : tcpdump (IV68951)	medium
81921	AIX 6.1 TL 8 : tcpdump (IV68950)	medium
81920	AIX 7.1 TL 3 : tcpdump (IV67588)	medium
81502	AIX 5.3 TL 12 : bind9 (IV68997)	high
81501	AIX 7.1 TL 3 : bind9 (IV68996)	high
81500	AIX 7.1 TL 2 : bind9 (IV68995)	high
81499	AIX 6.1 TL 9 : bind9 (IV68994)	high
81498	AIX 6.1 TL 8 : bind9 (IV68993)	high
81491	AIX Java Advisory : java_feb2015_advisory.asc (POODLE)	critical
81406	AIX OpenSSL Advisory : openssl_advisory12.asc (FREAK)	medium
81275	AIX 7.1 TL 3 : ntp (IV68430)	critical
81274	AIX 7.1 TL 2 : ntp (IV68429)	high
81273	AIX 6.1 TL 9 : ntp (IV68428)	high
81272	AIX 5.3 TL 12 : ntp (IV68427)	high
81271	AIX 6.1 TL 8 : ntp (IV68426)	high
81108	AIX 6.1 TL 9 : lvm (IV67907)	high
81022	AIX NAS Advisory : nas_advisory2.asc	low
80968	AIX 6.1 TL 8 : X11.base.lib (U867348)	high
80967	AIX 7.1 TL 2 : X11.base.lib (U865341)	high
80502	AIX 7.1 TL 2 : lvm (IV68478)	high
80500	AIX 6.1 TL 8 : lvm (IV68082)	high
80499	AIX 5.3 TL 12 : lvm (IV68070)	high
80498	AIX 7.1 TL 3 : lvm (IV67908)	high
79660	AIX rsyslog Advisory : rsyslog_advisory.asc	high
79626	AIX Java Advisory : java_oct2014_advisory.asc (POODLE)	critical
79063	AIX 7.1 TL 3 : bos.rte.control (U862099)	medium
79062	AIX 6.1 TL 9 : bos.rte.control (U861276)	medium
78772	AIX OpenSSL Advisory : openssl_advisory11.asc (POODLE)	high
77603	AIX OpenSSL Advisory : openssl_advisory10.asc	high
77532	AIX NAS Advisory : nas_advisory1.asc	high
77417	AIX 6.1 TL 7 : bos.rte.odm (U865807)	medium

Detections

Analytics

AIX Local Security Checks Family for Nessus

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

high

high

high

medium

high

medium

medium

medium

medium

high

high

high

high

high

critical

medium

critical

high

high

high

high

high

low

high

high

high

high

high

high

high

critical

medium

medium

high

high

high

medium