Security Bulletin: Vulnerability in tcpdump affects AIX (CVE-2018-19519)

Summary There is a vulnerability in tcpdump that affects AIX. Vulnerability Details CVEID: CVE-2018-19519 DESCRIPTION: Tcpdump is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the printprefix function of print-hncp.c. By using a specially-crafted packet data, ...

There is a vulnerability in tcpdump that affects AIX.,There is a vulnerability in tcpdump that affects VIOS.

IBM SECURITY ADVISORY First Issued: Mon Feb 25 16:54:49 CST 2019 |Updated: Tue Apr 9 09:55:34 CDT 2019 |Update: Increased the lower impacted fileset levels for some fileset | levels. Please see the Fileset table in AFFECTED PRODUCTS AND VERSIONS | for more information. The most recent version of...

Security Bulletin: Vulnerabilities in NTPv4 affect AIX (CVE-2018-12327, CVE-2018-7170)

Summary There is a vulnerability in NTPv4 that affects AIX. Vulnerability Details NTPv4 is vulnerable to: CVEID: CVE-2018-12327 DESCRIPTION: NTP is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by ntpq and ntpdc. By sending an overly long string argument, a local...

There are vulnerabilities in NTPv4 that affect AIX.

IBM SECURITY ADVISORY First Issued: Fri Dec 14 12:20:13 CST 2018 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/ntpadvisory11.asc https://aix.software.ibm.com/aix/efixes/security/ntpadvisory11.asc...

Security Bulletin: Vulnerabilities in OpenSSL affect AIX (CVE-2018-0734, CVE-2018-5407)

Summary There are vulnerabilities in OpenSSL used by AIX. Vulnerability Details CVEID: CVE-2018-0734 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a timing side channel attack in the DSA signature algorithm. An attacker could exploit this...

Security Bulletin: Vulnerability in Oracle Solaris affects AIX (CVE-2017-3623)

Summary There is a vulnerability in Oracle Solaris that affects AIX. Vulnerability Details CVEID: CVE-2017-3623 DESCRIPTION: An unspecified vulnerability in Oracle Sun Systems related to the Solaris Kernel RPC component could allow an unauthenticated attacker to take control of the system. CVSS...

There is a vulnerability in Xorg that affects AIX.,There is a vulnerability in Xorg that affects VIOS.

IBM SECURITY ADVISORY First Issued: Tue Dec 11 09:32:52 CST 2018 |Updated: Tue Apr 9 09:52:17 CDT 2019 |Update: Added AIX 7100-04-07 and 7200-02-03 as affected. | Added iFixes for AIX 7100-04-07 and 7200-02-03. The most recent version of this document is available here:...

There is a vulnerability in Oracle Solaris that affects AIX.,Vulnerability in Oracle Solaris affects AIX (CVE-2017-3623)

IBM SECURITY ADVISORY First Issued: Tue Dec 11 09:25:56 CST 2018 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/solarisadvisory.asc https://aix.software.ibm.com/aix/efixes/security/solarisadvisory.asc...

There is a vulnerability in FreeBSD that affects AIX.,There is a vulnerability in FreeBSD that affects VIOS.

IBM SECURITY ADVISORY First Issued: Thu Nov 8 14:04:12 CST 2018 |Updated: Wed Dec 5 12:11:30 CST 2018 |Update: iFixes now provided for AIX 7200-03-02 and VIOS 2.2.6.32, 3.1.0.0, | and 3.1.0.10. The most recent version of this document is available here:...

Vulnerabilities in OpenSSH affect AIX.

IBM SECURITY ADVISORY First Issued: Wed Oct 24 11:28:50 CDT 2018 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/opensshadvisory12.asc https://aix.software.ibm.com/aix/efixes/security/opensshadvisory12.asc...

Security Bulletin: IBM has released updated AIX and VIOS fixes for CVE-2017-5715, known as Spectre, that are only applicable to some POWER9 systems.

Summary IBM has released updated AIX and VIOS fixes for CVE-2017-5715, known as Spectre, that are only applicable to the following POWER9 systems: 9040-MR9 9080-M9S The prtconf command may be used to find the system model number. For example: prtconf | grep "System Model" Vulnerability Details...

Security Bulletin: IBM has released the following fixes for AIX and VIOS in response to Speculative Store Bypass (SSB), also known as Variant 4.

Summary IBM has released the following fixes for AIX and VIOS in response to CVE-2018-3639. Vulnerability Details CVEID: CVE-2018-3639 Affected Products and Versions AIX 5.3, 6.1, 7.1, 7.2 VIOS 2.2.x The vulnerabilities in the following filesets are being addressed: keyfileset = aix Fileset Lower...

IBM has released updated AIX and VIOS fixes for CVE-2017-5715 known as Spectre that are only applicable to some POWER9 systems.

IBM SECURITY ADVISORY First Issued: Fri Aug 17 08:05:01 CDT 2018 |Updated: Mon Sep 24 08:59:02 CDT 2018 |Update: Added system model 9080-M9S as a system to which the bulletin | applies. The most recent version of this document is available here:...

IBM AIX rmsock SetUID Binary Information Leak

Summary An exploitable kernel memory leak vulnerability is exposed by the rmsock setUID functionality of IBM AIX 6.1 and IBM AIX 7.1. A specially crafted command line can cause a kernel memory leak, resulting in uninitialized kernel memory being exposed. An attacker can execute rmuser with an...

Security Bulletin: Vulnerability in OpenSSL affects AIX (CVE-2018-0737)

Summary There is a vulnerability in OpenSSL used by AIX. Vulnerability Details CVEID: CVE-2018-0737 DESCRIPTION: The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during...

Vulnerability in rmsock affects AIX (CVE-2018-1655)

IBM SECURITY ADVISORY First Issued: Thu Jun 21 14:07:15 CDT 2018 |Updated: Tue Jul 3 08:09:45 CDT 2018 |Update: Additional iFixes are now available. Additional iFixes are now available | for: | AIX 6100-09-09 and 6100-09-10 | AIX 7100-04-04 and 7100-04-05 | AIX 7100-05-00 and 7100-05-01 | AIX...

Security Bulletin: Vulnerability in OpenSSL affects AIX (CVE-2018-0739)

Summary There is a vulnerability in OpenSSL used by AIX. Vulnerability Details CVEID: CVE-2018-0739 DESCRIPTION: Constructed ASN.1 types with a recursive definition such as can be found in PKCS7 could eventually exceed the stack given malicious input with excessive recursion. This could result in...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Security Directory Server for AIX/VIOS (CVE-2015-1788)

Summary OpenSSL is vulnerable to a denial of service, caused by an error when processing an ECParameters structure over a specially crafted binary polynomial field. A remote attacker could exploit this vulnerability to cause the application to enter into an infinite loop. Vulnerability Details...

IBM has released AIX and VIOS iFixes in response to Speculative Store Bypass (SSB) also known as Variant 4.,IBM has released AIX and VIOS iFixes in response to Speculative Store Bypass (SSB) also known as Variant 4.,IBM has released VIOS and VIOS iFixes in response to Speculative Store Bypass (SSB) also known as Variant 4.

IBM SECURITY ADVISORY First Issued: Tue May 22 15:30:11 CDT 2018 |Updated: Fri Aug 17 08:05:01 CDT 2018 |Update: Added a link to the bulletin for CVE-2017-5715, known as Spectre, | regarding updated iFixes that are only applicable to some POWER9 systems. | The bulletin is available here: |...

Multiple CPU Hardware CVE-2018-3639 Information Disclosure Vulnerability

Description Multiple CPU Hardware are prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in further attacks. Technologies Affected ARM Cortex A15 ARM Cortex A57 ARM Cortex A72 IBM AIX 5.3 IBM AIX 6.1 IBM AIX 7.1 IBM Aix...