10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.076 Low
EPSS
Percentile
94.2%
The remote host is missing AIX PTF U838020, which is related to the security of the package bos.net.tcp.client.
There is a buffer overflow vulnerability in the ftp server. By issuing an overly long NLST command, an attacker may cause a buffer overflow.
The successful exploitation of this vulnerability allows a remote attacker to get the DES encrypted user hashes off the server if FTP is configured to allow write access using Anonymous account or another account that is available to the attacker.
The following executable is vulnerable :
/usr/sbin/ftpd.
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were extracted
# from AIX Security PTF U838020. The text itself is copyright (C)
# International Business Machines Corp.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(52171);
script_version("1.9");
script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/04");
script_cve_id("CVE-2010-3187");
script_bugtraq_id(41762);
script_xref(name:"EDB-ID", value:"14409");
script_xref(name:"EDB-ID", value:"14456");
script_name(english:"AIX 5.3 TL 11 : bos.net.tcp.client (U838020)");
script_summary(english:"Check for PTF U838020");
script_set_attribute(
attribute:"synopsis",
value:"The remote AIX host is missing a vendor-supplied security patch."
);
script_set_attribute(
attribute:"description",
value:
"The remote host is missing AIX PTF U838020, which is related to the
security of the package bos.net.tcp.client.
There is a buffer overflow vulnerability in the ftp server. By issuing
an overly long NLST command, an attacker may cause a buffer overflow.
The successful exploitation of this vulnerability allows a remote
attacker to get the DES encrypted user hashes off the server if FTP is
configured to allow write access using Anonymous account or another
account that is available to the attacker.
The following executable is vulnerable :
/usr/sbin/ftpd."
);
script_set_attribute(
attribute:"see_also",
value:"http://www-01.ibm.com/support/docview.wss?uid=isg1IZ83275"
);
script_set_attribute(
attribute:"see_also",
value:"http://www-01.ibm.com/support/docview.wss?uid=isg1IZ90761"
);
script_set_attribute(
attribute:"see_also",
value:"http://www-01.ibm.com/support/docview.wss?uid=isg1IZ90765"
);
script_set_attribute(
attribute:"see_also",
value:"http://www-01.ibm.com/support/docview.wss?uid=isg1IZ91111"
);
script_set_attribute(
attribute:"solution",
value:"Install the appropriate missing security-related fix."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"exploited_by_malware", value:"true");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/o:ibm:aix:5.3");
script_set_attribute(attribute:"vuln_publication_date", value:"2010/08/20");
script_set_attribute(attribute:"patch_publication_date", value:"2010/08/20");
script_set_attribute(attribute:"plugin_publication_date", value:"2011/02/25");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"AIX Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/AIX/oslevel", "Host/AIX/version", "Host/AIX/lslpp");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("aix.inc");
if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if ( ! get_kb_item("Host/AIX/version") ) audit(AUDIT_OS_NOT, "AIX");
if ( ! get_kb_item("Host/AIX/lslpp") ) audit(AUDIT_PACKAGE_LIST_MISSING);
flag = 0;
if ( aix_check_patch(ml:"530011", patch:"U838020", package:"bos.net.tcp.client.5.3.11.5") < 0 ) flag++;
if (flag)
{
if (report_verbosity > 0) security_hole(port:0, extra:aix_report_get());
else security_hole(0);
exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");