Information disclosure

The NFSv4 client implementation in IBM AIX 5.3, 6.1, and 7.1, and VIOS before 2.2.1.4-FP-25 SP-02, does not properly handle GID values, which allows remote attackers to cause a denial of service via unspecified vectors...

CVE-2012-2188

IBM Power Hardware Management Console HMC 7R3.5.0 before SP4, 7R7.1.0 and 7R7.2.0 before 7R7.2.0 SP3, and 7R7.3.0 before SP2, and Systems Director Management Console SDMC 6R7.3.0 before SP2, does not properly restrict the VIOS viosrvcmd command, which allows local users to gain privileges via...

Command injection

IBM Power Hardware Management Console HMC 7R3.5.0 before SP4, 7R7.1.0 and 7R7.2.0 before 7R7.2.0 SP3, and 7R7.3.0 before SP2, and Systems Director Management Console SDMC 6R7.3.0 before SP2, does not properly restrict the VIOS viosrvcmd command, which allows local users to gain privileges via...

CVE-2012-2188

Vulnerability CVE-2012-2188 affects IBM Power Hardware Management Console (HMC) and Systems Director Management Console (SDMC). The root cause is improper restriction of the VIOS viosrvcmd command, enabling local users to gain privileges via vectors involving a $ or & character. Affected versions...

Multiple OpenSSL vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 IBM SECURITY ADVISORY First Issued: Wed Aug 1 09:25:58 CDT 2012 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/openssladvisory4.asc or...

CVE-2012-0723

The kernel in IBM AIX 5.3, 6.1, and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly implement the dupmsg system call, which allows local users to cause a denial of service system crash via a crafted application...

Code injection

The kernel in IBM AIX 5.3, 6.1, and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly implement the dupmsg system call, which allows local users to cause a denial of service system crash via a crafted application...

CVE-2012-0723

Summary: Local denial of service on IBM AIX 5.3/6.1/7.1 and VIOS 2.2.1.4-FP-25 SP-02 due to a flaw in the dupmsg kernel call. Root cause: a kernel extension call is exported to user space without proper sanity checks, allowing a crafted application to crash the system. Impacted components: AIX ke...

CVE-2012-2200

The default configuration of sendmail in IBM AIX 6.1 and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, allows local users to gain privileges by entering a command in a .forward file in a home directory...

Default configuration

The default configuration of sendmail in IBM AIX 6.1 and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, allows local users to gain privileges by entering a command in a .forward file in a home directory...

CVE-2012-2200

The CVE-2012-2200 issue affects IBM AIX 6.1/7.1 (and VIOS 2.2.1.4-FP-25 SP-02) where the default sendmail configuration allows local users to gain root privileges by placing a command in a user’s .forward file. The root cause is execution of commands piped from the .forward mechanism within stock...

CVE-2012-2200

The default configuration of sendmail in IBM AIX 6.1 and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, allows local users to gain privileges by entering a command in a .forward file in a home directory...

CVE-2012-2192

The socketpair function in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.1.4-FP-25 SP-02 allows local users to cause a denial of service system crash via a crafted application that leverages the presence of a socket on the free list...

Code injection

The socketpair function in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.1.4-FP-25 SP-02 allows local users to cause a denial of service system crash via a crafted application that leverages the presence of a socket on the free list...

CVE-2012-2192

Summary: CVE-2012-2192 affects IBM AIX 5.3, 6.1, 7.1 and VIOS 2.2.1.4-FP-25 SP-02. Vulnerability: socketpair() usage can cause a local denial-of-service (system crash) when a socket remains on the free list, triggering a crash in the socket code path. Root cause: crash tied to how sockets are man...

CVE-2012-2192

The socketpair function in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.1.4-FP-25 SP-02 allows local users to cause a denial of service system crash via a crafted application that leverages the presence of a socket on the free list...

CVE-2012-0745

The getpwnam function in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.1.0.10 through 2.2.1.3 does not properly interact with customer-extended LDAP user filtering, which allows local users to gain privileges via unspecified vectors...

Design/Logic Flaw

The getpwnam function in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.1.0.10 through 2.2.1.3 does not properly interact with customer-extended LDAP user filtering, which allows local users to gain privileges via unspecified vectors...

CVE-2012-0745

The getpwnam function in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.1.0.10 through 2.2.1.3 does not properly interact with customer-extended LDAP user filtering, which allows local users to gain privileges via unspecified vectors...

Multiple OpenSSL vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 IBM SECURITY ADVISORY First Issued: Wed Mar 21 13:02:49 CDT 2012 |Updated: Thu Mar 22 09:06:21 CDT 2012 |Added VIOS release reference |Updated: Tue Jun 5 11:06:56 CDT 2012 |Corrected FIPS version The most recent version of this document is available...