AIX 6.1 TL 4 : sendmail (IZ70637)

'sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name CN field of an X.509 certificate, which 1 allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and 2 allows...

AIX 6.1 TL 2 : sendmail (IZ72515)

'sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name CN field of an X.509 certificate, which 1 allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and 2 allows...

AIX 5.3 TL 8 : sendmail (IZ72834)

'sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name CN field of an X.509 certificate, which 1 allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and 2 allows...

AIX 5.2 TL 0 : swcons (IZ18335)

A file permission/ownership vulnerability exists in the 'bos.rte.console' fileset command listed below whereby a local attacker may create arbitrary contents within a file owned by root using the 'swcons' command. The local attacker must be a member of the 'system' group gid=0 to execute this...

AIX 5.3 TL 12 : icmp (IV13827)

There is an error in the handling of a particular ICMP packet in which a remote user can cause a denial of service. Note: The ifixes provided also contain the fix for CVE-2012-0194 since they affect the same fileset. See the following for CVE-2012-0194:...

AIX 5.3 TL 9 : muxatmd (IZ48501)

The muxatmd command contains a buffer which can overflow. A local attacker may exploit this overflow to execute arbitrary code with root privileges because the command is setuid root. The following file is vulnerable : /usr/sbin/muxatmd. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The te...

AIX 6.1 TL 0 : ps (IZ11244)

An information leak exists in the 'bos.rte.control' fileset commands listed below. A local attacker may access sensitive information for arbitrary processes. The following commands are vulnerable : /usr/bin/ps. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text in the description was...

AIX 6.1 TL 0 : muxatmd (IZ48502)

The muxatmd command contains a buffer which can overflow. A local attacker may exploit this overflow to execute arbitrary code with root privileges because the command is setuid root. The following file is vulnerable : /usr/sbin/muxatmd. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The te...

AIX 6.1 TL 7 : sendmail1 (IV22966)

AIX system set up with stock sendmail will run arbitrary code through a users .forward. This apples to sendmailssl and sendmailnossl. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text in the description was extracted from AIX Security Advisory sendmail1advisory.asc...

AIX 7.1 TL 1 : bind9 (IV10049)

An as-yet unidentified network event caused BIND 9 resolvers to cache an invalid record, subsequent queries for which could crash the resolvers with an assertion failure. Furthermore, AIX BIND 9.4.1 is affected by the following three security vulnerabilities: CVE-2010-0382 - ISC BIND...

AIX 5.3 TL 0 : lsmcode (IZ15100)

The lsmcode command contains an environment variable handling error. A local attacker may exploit this error to execute arbitrary code with root privileges because the command is setuid root. The following files are vulnerable : /usr/sbin/lsmcode. %NASLMINLEVEL 70300 C Tenable Network Security,...

AIX 5.3 TL 8 : muxatmd (IZ48500)

The muxatmd command contains a buffer which can overflow. A local attacker may exploit this overflow to execute arbitrary code with root privileges because the command is setuid root. The following file is vulnerable : /usr/sbin/muxatmd. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The te...

AIX 5.3 TL 9 : xntpd (IZ71093)

'NTP mode 7 MODEPRIVATE is used by the ntpdc query and control utility. In contrast, ntpq uses NTP mode 6 MODECONTROL, while routine NTP time transfers use modes 1 through 5. Upon receipt of an incorrect mode 7 request or a mode 7 error response from an address that is not listed in a 'restrict...

AIX 5.3 TL 10 : ftpd (IZ83274)

There is a buffer overflow vulnerability in the ftp server. By issuing an overly long NLST command, an attacker may cause a buffer overflow. The successful exploitation of this vulnerability allows a remote attacker to get the DES encrypted user hashes off the server if FTP is configured to allow...

AIX 6.1 TL 3 : xntpd (IZ71614)

'NTP mode 7 MODEPRIVATE is used by the ntpdc query and control utility. In contrast, ntpq uses NTP mode 6 MODECONTROL, while routine NTP time transfers use modes 1 through 5. Upon receipt of an incorrect mode 7 request or a mode 7 error response from an address that is not listed in a 'restrict...

AIX 7.1 TL 1 : socket (IV21235)

When socketpair calls are used on the system we could see a crash in socket code path due to the fact that one of the socket is in the free list. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text in the description was extracted from AIX Security Advisory socketadvisory.asc...

AIX 5.3 TL 8 : bind (IZ56312)

AIX 'named' is an implementation of BIND Berkeley Internet Name Domain providing server functionality for the Domain Name System DNS Protocol. AIX currently ships and supports three versions of BIND: 4, 8, and 9. There is an error in the handling of dynamic update messages in BIND 9. A crafted...

AIX 5.3 TL 12 : ldapauth (IV18638)

AIX could allow a local attacker to gain elevated privileges on the system, caused by an error in the getpwnam function when customer extended LDAP user filtering is configured. A local attacker could exploit this vulnerability to gain lateral or elevated privileges on the system. %NASLMINLEVEL...

AIX 6.1 TL 7 : syscall (IV22695)

A kernel extension call is exported to user space without proper sanity checks causing a system crash. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text in the description was extracted from AIX Security Advisory syscalladvisory.asc. include'deprecatednasllevel.inc';...

AIX 5.3 TL 12 : bind9 (IV30368)

If specific combinations of RDATA are loaded into a nameserver, either via cache or an authoritative zone, a subsequent query for a related record will cause named to lock up. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text in the description was extracted from AIX Security Advisory...