Patches available for IBM AIX flaws

[NGSSoftware Insight Security Research]

David Litchfield of NGSSoftware has discovered a multiple high risk
vulnerabilities in IBM's AIX operating systems.

1) There is a buffer overflow in the malloc debug system that when exploited
can yeild root privileges.
2) There is a buffer overflow in muxatmd which is setuid root.
3) There is a buffer overflow in slocal which is setuid root.
4) There are arbitrary file data append issues in getShell and getCommand in
conjuction with specific settings in the malloc debug system.Both getShell
and getCommand are setuid root.

Issue 1 affects AIX versions 5.3.
Issue 2 affects AIX versions 5.3, 5.2 and 5.1.
Issue 3 affects AIX versions 5.3, 5.2 and 5.1.
Issue 4 affects AIX versions 5.3, 5.2 and 5.1.

IBM has developed patches for these issues:

http://www-03.ibm.com/servers/eserver/support/unixservers/aixfixes.html

Administrators are urged to install the patches as soon as possible. Whilst
these attacks are "local" by nature, AIX servers running Informix, DB2 and
Oracle can be targeted remotely via specific SQL queries.

NGSSoftware Insight Security Research
http://www.ngssoftware.com/
http://www.databasesecurity.com/
+44(0)208 401 0070

[Shiva Persaud]

--ctP54qlpMx3WjD+/
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

One correction: the getShell/getCommand issue only pertains to AIX 5.3.

Advisories and fixes are available at:
https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs


Shiva Persaud,
AIX Security

--ctP54qlpMx3WjD+/
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDoso7L6zf98kMBI0RAtolAJ4s3NMrCZ80o+IZujmkYj ne5WA6LQCcCzEL
dL9uA61OAz7IpGBQbc7TFFg=
=sZsC
-----END PGP SIGNATURE-----

--ctP54qlpMx3WjD+/--

[David Litchfield]

Correction:

> 4) There are arbitrary file data append issues in getShell and getCommand
> in conjuction with specific settings in the malloc debug system.Both
> getShell and getCommand are setuid root.

> Issue 4 affects AIX versions 5.3, 5.2 and 5.1.

Issue 4 affects only AIX 5.3 and not 5.2 and 5.1 as was indicated.
Apologies!
Cheers,
David