[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

UNIRAS Brief - 446/05 - Five IBM Security Advisories:



 
-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------------------
   UNIRAS (UK Govt CERT) Briefing Notice - 446/05 dated 10.06.05  Time: 15:45  
  UNIRAS is part of NISCC (National Infrastructure Security Co-ordination Centre)
- ---------------------------------------------------------------------------------- 
  UNIRAS material is also available from its website at www.uniras.gov.uk and
         Information about NISCC is available from www.niscc.gov.uk
- ----------------------------------------------------------------------------------

Title
=====

Five IBM Security Advisories:

1. Buffer overflow vulnerability in diagTasksWebSM

2. Buffer overflow vulnerability in invscout

3. Buffer overflow vulnerability in getlvname

4. Buffer overflow vulnerability in invscout

5. Buffer overflow vulnerability in getlvname

Detail
====== 

1. A vulnerability was discovered in the diagTasksWebSM command that allows a
local user in the system group to gain root privileges. Exploits for this
vulnerability may be publicly available.

2. A vulnerability was discovered in the invscout command that allows a local
user to gain root privileges. Exploits for this vulnerability may be
publicly available.

3. A vulnerability was discovered in the getlvname command that allows a
local user in the system group to gain root privileges. Exploits for this
vulnerability may be publicly available.

4. A vulnerability was discovered in the invscout command that allows a local
user to gain root privileges. Exploits for this vulnerability may be
publicly available.

5. A vulnerability was discovered in the getlvname command that allows a
local user in the system group to gain root privileges. Exploits for this
vulnerability may be publicly available.




1.
  

AIX 5.2 : Security advisories (2005.06.09)

Buffer overflow vulnerability in diagTasksWebSM

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

IBM SECURITY ADVISORY

First Issued:  Thu Jun  9 18:09:13 CDT 2005

==========================================================================
                           VULNERABILITY SUMMARY

VULNERABILITY:      A buffer overflow vulnerability in the diagTasksWebSM
                    command may allow any local user in the system group
                    to gain root privileges.

PLATFORMS:          AIX 5.1, 5.2 and 5.3.

SOLUTION:           Apply the workaround as described below.

THREAT:             A local user in the system group may gain root
                    privileges.

CERT VU Number:     N/A
CVE Number:         N/A
=========================================================================
                           DETAILED INFORMATION


I.  Description
===============

A vulnerability was discovered in the diagTasksWebSM command that allows a
local user in the system group to gain root privileges. Exploits for this
vulnerability may be publicly available.

The command affected by this issue ships as part of the bos.diag.rte
fileset. To determine if this fileset is installed, execute the following
command:

# lslpp -L bos.diag.rte

If the fileset is installed it will be listed along with its version
information, state, type and a description.


II. Impact
==========

A local user in the system group may exploit this buffer overflow
vulnerability to gain root privileges.


III.  Solutions
===============

A. APARs and interim fixes

APARs and interim fixes will be provided. An updated advisory will be
published when these fixes are available.


B. Workaround

Setting the file mode bits to 500 will allow only the root user to execute
this command. This can be done by executing the following command as root:

#  chmod 500 /usr/lpp/diagnostics/bin/diagTasksWebSM

Verify that the file mode bits have been updated:

# cd /usr/lpp/diagnostics/bin
# ls -la diagTasksWebSM
- - -r-x------   1 root     system         5946 Mar 14 08:05 diagTasksWebSM


IV. Obtaining Fixes
===================

AIX Version 5 APARs can be downloaded from:

     http://www-1.ibm.com/servers/eserver/support/pseries/aixfixes.html

Security related Interim Fixes can be downloaded from:

     ftp://aix.software.ibm.com/aix/efixes/security


V.  Contact Information
=======================

If you would like to receive AIX Security Advisories via email, please
visit:

     https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs

Comments regarding the content of this announcement can be directed to:

     security-alert@xxxxxxxxxxxxxx

To request the PGP public key that can be used to communicate securely
with the AIX Security Team send email to security-alert@xxxxxxxxxxxxxx
with a subject of "get key". The key can also be downloaded from a PGP
Public Key Server. The key id is 0x9391C1F2.

Please contact your local IBM AIX support center for any assistance.

eServer is a trademark of International Business Machines Corporation.
IBM, AIX and pSeries are registered trademarks of International Business
Machines Corporation. All other trademarks are property of their respective
holders.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFCqM/RxwSSvpORwfIRAjibAJ0cJsxwR/hFMnFmO5ALbcupGTUeKQCdE0Ly
lCcy/KJkvK7HXG4FGJ3QhiA=
=gVMs
- -----END PGP SIGNATURE-----



2.

  
AIX 5.2 : Security advisories (2005.06.09)

Buffer overflow vulnerability in invscout

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

IBM SECURITY ADVISORY

First Issued: Thu Jun  9 13:31:06 CDT 2005

=========================================================================
                           VULNERABILITY SUMMARY

VULNERABILITY:      A buffer overflow vulnerability in the invscout command
                    allows any local user to get root privileges.

PLATFORMS:          AIX 5.1, 5.2 and 5.3.

SOLUTION:           Apply the workaround as described below.

THREAT:             A local user may gain root privileges.

CERT VU Number:     N/A
CVE Number:         N/A
=========================================================================
                           DETAILED INFORMATION


I.  Description
===============

A vulnerability was discovered in the invscout command that allows a local
user to gain root privileges. Exploits for this vulnerability may be
publicly available.

The command affected by this issue ships as part of the invscout.rte
fileset. To determine if this fileset is installed, execute the following
command:

# lslpp -L invscout.rte

If the fileset is installed it will be listed along with its version
information, state, type and a description.


II. Impact
==========
Any local user can exploit this buffer overflow vulnerability to gain root
privileges.


III.  Solutions
===============

A. APARs and interim fixes

APARs and interim fixes will be provided. An updated advisory will be
published when these fixes are available.


B. Workaround

Setting the file mode bits to 500 will allow only the root user to execute
this command. This can be done by executing the following command as root:

# chmod 500 /usr/sbin/invscout

Verify that the file mode bits have been updated:

# ls -la /usr/sbin/invscout
- - - -r-x------   1 root     system       465974 Mar 17 11:25 /usr/sbin/invscout



IV. Obtaining Fixes
===================

AIX Version 5 APARs can be downloaded from:

     http://www-1.ibm.com/servers/eserver/support/pseries/aixfixes.html

Security related Interim Fixes can be downloaded from:

     ftp://aix.software.ibm.com/aix/efixes/security


V.  Contact Information
=======================

If you would like to receive AIX Security Advisories via email, please
visit:

     https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs

Comments regarding the content of this announcement can be directed to:

     security-alert@xxxxxxxxxxxxxx

To request the PGP public key that can be used to communicate securely
with the AIX Security Team send email to security-alert@xxxxxxxxxxxxxx
with a subject of "get key". The key can also be downloaded from a PGP
Public Key Server. The key id is 0x9391C1F2.

Please contact your local IBM AIX support center for any assistance.

eServer is a trademark of International Business Machines Corporation.
IBM, AIX and pSeries are registered trademarks of International Business
Machines Corporation. All other trademarks are property of their respective
holders.

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFCqLfqxwSSvpORwfIRAjQVAJ4h7oyNSPoRipOKB6mTN1mGIYaIAQCfS4qh
n+LY4BC8nhSIrQomorpI9pU=
=U2md
- -----END PGP SIGNATURE-----


3.


  
AIX 5.2 : Security advisories (2005.06.09)

Buffer overflow vulnerability in getlvname

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

IBM SECURITY ADVISORY

First Issued: Thu Jun  9 13:31:06 CDT 2005

==========================================================================
                           VULNERABILITY SUMMARY

VULNERABILITY:      A buffer overflow vulnerability in the getlvname
		    command may allow any local user in the system group
                    to gain root privileges.

PLATFORMS:          AIX 5.1, 5.2 and 5.3.

SOLUTION:           Apply the workaround as described below.

THREAT:             A local in the system group may gain root privileges.

CERT VU Number:     N/A
CVE Number:         N/A
=========================================================================
                           DETAILED INFORMATION


I.  Description
===============

A vulnerability was discovered in the getlvname command that allows a
local user in the system group to gain root privileges. Exploits for this
vulnerability may be publicly available.

The command affected by this issue ships as part of the bos.rte.lvm
fileset. To determine if this fileset is installed, execute the following
command:

# lslpp -L bos.rte.lvm

If the fileset is installed it will be listed along with its version
information, state, type and a description.


II. Impact
==========

A local user in the system group may exploit this buffer overflow
vulnerability to gain root privileges.


III.  Solutions
===============

A. APARs and interim fixes

APARs and interim fixes will be provided. An updated advisory will be
published when these fixes are available.


B. Workaround

Setting the file mode bits to 500 will allow only the root user to execute
this command. This can be done by executing the following command as root:

# chmod 500 /usr/sbin/getlvname

Verify that the file mode bits have been updated:

# ls -la /usr/sbin/getlvname
- - -r-x------   1 root     system   8392 May 16 14:30 /usr/sbin/getlvname


IV. Obtaining Fixes
===================

AIX Version 5 APARs can be downloaded from:

     http://www-1.ibm.com/servers/eserver/support/pseries/aixfixes.html

Security related Interim Fixes can be downloaded from:

     ftp://aix.software.ibm.com/aix/efixes/security


V.  Contact Information
=======================

If you would like to receive AIX Security Advisories via email, please
visit:

     https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs

Comments regarding the content of this announcement can be directed to:

     security-alert@xxxxxxxxxxxxxx

To request the PGP public key that can be used to communicate securely
with the AIX Security Team send email to security-alert@xxxxxxxxxxxxxx
with a subject of "get key". The key can also be downloaded from a PGP
Public Key Server. The key id is 0x9391C1F2.

Please contact your local IBM AIX support center for any assistance.

eServer is a trademark of International Business Machines Corporation.
IBM, AIX and pSeries are registered trademarks of International Business
Machines Corporation. All other trademarks are property of their respective
holders.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFCqLSgxwSSvpORwfIRAv/GAJ4y7ODL395tN5+nQvPFPgFyxHYPMACeNaXl
OBpMjkCw5e+KGLeWe5lwqgo=
=/7LI
- -----END PGP SIGNATURE-----


4.


 
AIX 5.1 : Security advisories (2005.06.09)

Buffer overflow vulnerability in invscout

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

IBM SECURITY ADVISORY

First Issued: Thu Jun  9 13:31:06 CDT 2005

=========================================================================
                           VULNERABILITY SUMMARY

VULNERABILITY:      A buffer overflow vulnerability in the invscout command
                    allows any local user to get root privileges.

PLATFORMS:          AIX 5.1, 5.2 and 5.3.

SOLUTION:           Apply the workaround as described below.

THREAT:             A local user may gain root privileges.

CERT VU Number:     N/A
CVE Number:         N/A
=========================================================================
                           DETAILED INFORMATION


I.  Description
===============

A vulnerability was discovered in the invscout command that allows a local
user to gain root privileges. Exploits for this vulnerability may be
publicly available.

The command affected by this issue ships as part of the invscout.rte
fileset. To determine if this fileset is installed, execute the following
command:

# lslpp -L invscout.rte

If the fileset is installed it will be listed along with its version
information, state, type and a description.


II. Impact
==========
Any local user can exploit this buffer overflow vulnerability to gain root
privileges.


III.  Solutions
===============

A. APARs and interim fixes

APARs and interim fixes will be provided. An updated advisory will be
published when these fixes are available.


B. Workaround

Setting the file mode bits to 500 will allow only the root user to execute
this command. This can be done by executing the following command as root:

# chmod 500 /usr/sbin/invscout

Verify that the file mode bits have been updated:

# ls -la /usr/sbin/invscout
- - - -r-x------   1 root     system       465974 Mar 17 11:25 /usr/sbin/invscout



IV. Obtaining Fixes
===================

AIX Version 5 APARs can be downloaded from:

     http://www-1.ibm.com/servers/eserver/support/pseries/aixfixes.html

Security related Interim Fixes can be downloaded from:

     ftp://aix.software.ibm.com/aix/efixes/security


V.  Contact Information
=======================

If you would like to receive AIX Security Advisories via email, please
visit:

     https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs

Comments regarding the content of this announcement can be directed to:

     security-alert@xxxxxxxxxxxxxx

To request the PGP public key that can be used to communicate securely
with the AIX Security Team send email to security-alert@xxxxxxxxxxxxxx
with a subject of "get key". The key can also be downloaded from a PGP
Public Key Server. The key id is 0x9391C1F2.

Please contact your local IBM AIX support center for any assistance.

eServer is a trademark of International Business Machines Corporation.
IBM, AIX and pSeries are registered trademarks of International Business
Machines Corporation. All other trademarks are property of their respective
holders.

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFCqLfqxwSSvpORwfIRAjQVAJ4h7oyNSPoRipOKB6mTN1mGIYaIAQCfS4qh
n+LY4BC8nhSIrQomorpI9pU=
=U2md
- -----END PGP SIGNATURE-----


5.


 
AIX 5.1 : Security advisories (2005.06.09)

Buffer overflow vulnerability in getlvname

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

IBM SECURITY ADVISORY

First Issued: Thu Jun  9 13:31:06 CDT 2005

==========================================================================
                           VULNERABILITY SUMMARY

VULNERABILITY:      A buffer overflow vulnerability in the getlvname
		    command may allow any local user in the system group
                    to gain root privileges.

PLATFORMS:          AIX 5.1, 5.2 and 5.3.

SOLUTION:           Apply the workaround as described below.

THREAT:             A local in the system group may gain root privileges.

CERT VU Number:     N/A
CVE Number:         N/A
=========================================================================
                           DETAILED INFORMATION


I.  Description
===============

A vulnerability was discovered in the getlvname command that allows a
local user in the system group to gain root privileges. Exploits for this
vulnerability may be publicly available.

The command affected by this issue ships as part of the bos.rte.lvm
fileset. To determine if this fileset is installed, execute the following
command:

# lslpp -L bos.rte.lvm

If the fileset is installed it will be listed along with its version
information, state, type and a description.


II. Impact
==========

A local user in the system group may exploit this buffer overflow
vulnerability to gain root privileges.


III.  Solutions
===============

A. APARs and interim fixes

APARs and interim fixes will be provided. An updated advisory will be
published when these fixes are available.


B. Workaround

Setting the file mode bits to 500 will allow only the root user to execute
this command. This can be done by executing the following command as root:

# chmod 500 /usr/sbin/getlvname

Verify that the file mode bits have been updated:

# ls -la /usr/sbin/getlvname
- - -r-x------   1 root     system   8392 May 16 14:30 /usr/sbin/getlvname


IV. Obtaining Fixes
===================

AIX Version 5 APARs can be downloaded from:

     http://www-1.ibm.com/servers/eserver/support/pseries/aixfixes.html

Security related Interim Fixes can be downloaded from:

     ftp://aix.software.ibm.com/aix/efixes/security


V.  Contact Information
=======================

If you would like to receive AIX Security Advisories via email, please
visit:

     https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs

Comments regarding the content of this announcement can be directed to:

     security-alert@xxxxxxxxxxxxxx

To request the PGP public key that can be used to communicate securely
with the AIX Security Team send email to security-alert@xxxxxxxxxxxxxx
with a subject of "get key". The key can also be downloaded from a PGP
Public Key Server. The key id is 0x9391C1F2.

Please contact your local IBM AIX support center for any assistance.

eServer is a trademark of International Business Machines Corporation.
IBM, AIX and pSeries are registered trademarks of International Business
Machines Corporation. All other trademarks are property of their respective
holders.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFCqLSgxwSSvpORwfIRAv/GAJ4y7ODL395tN5+nQvPFPgFyxHYPMACeNaXl
OBpMjkCw5e+KGLeWe5lwqgo=
=/7LI
- -----END PGP SIGNATURE-----



- ----------------------------------------------------------------------------------

For additional information or assistance, please contact the HELP Desk by 
telephone or Not Protectively Marked information may be sent via 
EMail to: uniras@xxxxxxxxxxxx

Office Hours:
Mon - Fri: 08:30 - 17:00 Hrs
Tel: +44 (0) 870 487 0748 Ext 4511
Fax: +44 (0) 870 487 0749

Outside of Office Hours:
On Call Duty Officer:
Tel: +44 (0) 870 487 0748 and follow the prompts

- ----------------------------------------------------------------------------------
UNIRAS wishes to acknowledge the contributions of IBM for the information 
contained in this Briefing. 
- ----------------------------------------------------------------------------------
This Briefing contains the information released by the original author. Some 
of the information may have changed since it was released. If the vulnerability 
affects you, it may be prudent to retrieve the advisory from the canonical site 
to ensure that you receive the most current information concerning that problem.

Reference to any specific commercial product, process, or service by trade 
name, trademark manufacturer, or otherwise, does not constitute or imply 
its endorsement, recommendation, or favouring by UNIRAS or NISCC.  The views 
and opinions of authors expressed within this notice shall not be used for 
advertising or product endorsement purposes.

Neither UNIRAS or NISCC shall also accept responsibility for any errors 
or omissions contained within this briefing notice. In particular, they shall 
not be liable for any loss or damage whatsoever, arising from or in connection 
with the usage of information contained within this notice.

UNIRAS is a member of the Forum of Incident Response and Security Teams (FIRST) 
and has contacts with other international Incident Response Teams (IRTs) in 
order to foster cooperation and coordination in incident prevention, to prompt 
rapid reaction to incidents, and to promote information sharing amongst its 
members and the community at large. 
- ----------------------------------------------------------------------------------
<End of UNIRAS Briefing>

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQCVAwUBQqmloIpao72zK539AQFBowP/cUD2v9ErVF6Cwkh78snm4eNt3fXzkchV
KasywsDJQBJBwPaFhx3OECXsqD8rogKqhTKFzarNKemDbNzvTgl0sm/54wKJRm/r
aJtbG15mcVsEGlAECjASm4ltCy4BilVtJvxxL5RhbYRa5Lrs9J0yhYbQMZLEOWEv
4ury/MGiCWw=
=22Jg
-----END PGP SIGNATURE-----


______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________