Search:

July 2007

3285 - IBM AIX Advisories

ID: 3285
Date: 30 July 2007 13:33

Title: 3285 - IBM AIX Advisories
Abstract: Details of several IBM AIX security advisories
Vendors affected:IBM
Applications affected:arp, capture, ftp, pioout, pioinit, lpd
Warning Status: Imminent
Availability of fix: Available
Type of fix: Patch
Source: ibm
Reliability of source: Trusted

AIX 5.3 : Security advisories (2007.07.26)

AIX pioout Arbitrary Library Loading Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

IBM SECURITY ADVISORY

First Issued: Thu Jul 19 16:51:01 CDT 2007 ===============================================================================
VULNERABILITY SUMMARY

VULNERABILITY: AIX pioout Arbitrary Library Loading Vulnerability

PLATFORMS: AIX 5.2, 5.3

SOLUTION: Apply the APAR, interim fix or workaround as described
below.

THREAT: An attacker may run arbitrary code with root privileges.

CERT VU Number: n/a
CVE Number: n/a
===============================================================================
DETAILED INFORMATION

I. OVERVIEW

The pioout command is at the end of pipelines invoked by the piobe command
(the print job manager) to print a file or a burst page on a printer.

II. DESCRIPTION

    An arbitrary library loading vulnerability exists within the pioout command
    which allows a non-privileged user to execute arbitrary code with super-
    user privileges. This vulnerability is the result of pioout being setuid
    and world executable.

III. IMPACT

Successful exploitation of this vulnerability will allow a local user to
run arbitrary code with root privileges.

IV. PLATFORM VULNERABILITY ASSESSMENT

To determine if your system is vulnerable, run the following command:

# lslpp -l | grep printers.rte

The following filesets are vulnerable:

    AIX Level           Lower Level       Upper Level
    -------------------------------------------------
    5.2.0               5.2.0.75          5.2.0.105
    5.3.0               5.3.0.30          5.3.0.60

V. SOLUTIONS

A. APARS

IBM provides the following fixes:

        AIX Level           APAR number       Availability
        --------------------------------------------------------------------
        5.2.0               IZ01121           10/31/2007 (subject to change)
        5.3.0               IZ01122           08/08/2007 (subject to change)

AIX Version 5 APARs can be downloaded from:

http://www.ibm.com/servers/eserver/support/unixservers/aixfixes.html

NOTE: Affected customers are urged to upgrade to the latest applicable
Technology Level and Service Pack.

B. INTERIM FIXES

Interim fixes are available. The interim fix can be downloaded via
ftp from:

ftp://aix.software.ibm.com/aix/efixes/security/pioout_ifix.tar.Z

        This is a compressed tarball containing this advisory, interim fix
        packages and PGP signatures for each package. The interim fixes below
        include prerequisite checking. This will enforce the correct mapping
        between the fixes and AIX Technology Levels.

        AIX Release & Technology Level         Interim fix
        ---------------------------------------------------------------
        5200-08                                IZ01121_08.070719.epkg.Z
        5200-09                                IZ01121_09.070719.epkg.Z
        5200-10                                IZ01121_10.070719.epkg.Z
        5300-04                                IZ01122_04.070719.epkg.Z
        5300-05                                IZ01122_05.070719.epkg.Z
        5300-06                                IZ01122_06.070719.epkg.Z

        IMPORTANT: If possible, it is recommended that a mksysb backup of the
        system be created. Verify it is both bootable and readable before
        proceeding.

        These interim fixes have not been fully regression tested; thus, IBM
        does not warrant the fully correct functionality of the interim fix.
        Customers install the interim fix and operate the modified version of
        AIX at their own risk.

Verify you have retrieved the fixes intact:

        The interim fixes below are named by using the technology level
        corresponding to the release that the fix applies to. The checksums
        below were generated using the "sum" and "md5sum" commands and are as
        follows:

        Filename                   sum        md5sum
        ----------------------------------------------------------------------
        IZ01121_08.070710.epkg.Z   50647 45   a821b7be0890066ebb7e08370c2431bb
        IZ01121_09.070710.epkg.Z   15247 45   e38cb8dcd2e46b2a0d260beac059f075
        IZ01121_10.070710.epkg.Z   43854 45   fe45e6967d616b829b26452def22dd20
        IZ01122_04.070710.epkg.Z   14449 45   3da46671ac956c0ec341da0f6ea56ea6
        IZ01122_05.070710.epkg.Z   10193 45   878460aa65e0446d692e6d9585475c9a
        IZ01122_06.070710.epkg.Z   29050 46   3f14967bcb2deeb3fc9a34fbd21ea52d

        These sums should match exactly. The PGP signatures in the
        compressed tarball and on this advisory can also be used to verify
        the integrity of the various files they correspond to. If the sums
        or signatures cannot be confirmed, double check the command results
        and the download site address. If those are OK, contact IBM AIX
        Security at security-alert@austin.ibm.com and describe the
        discrepancy.

C. INTERIM FIX INSTALLATION

These packages use the new Interim Fix Management Solution to install
and manage interim fixes. More information can be found at:

http://www14.software.ibm.com/webapp/set2/sas/f/aix.efixmgmt/home.html

To preview an epkg interim fix installation execute the following
command:

# emgr -e ipkg_name -p # where ipkg_name is the name of the
# interim fix package being previewed.

To install an epkg interim fix package, execute the following command:

# emgr -e ipkg_name -X # where ipkg_name is the name of the
# interim fix package being installed.

The "X" flag will expand any filesystems if required.

VI. WORKAROUNDS

A. OPTION 1

In most cases the pioout command will only be run by a privileged user
and can have its permissions altered with the following command:

# chmod 500 /usr/lib/lpd/pio/etc/pioout

NOTE: This will affect users of the printq group attempting to run this
command.

B. OPTION 2

        Customers running AIX 5.3.0 TL06 may install the bos.rte.security
        fileset and take advantage of the 'fpm' command to disable the setuid
        capabilities of pioout. The pioout command is part of the 'high' level
        database.

VII. OBTAINING FIXES

AIX Version 5 APARs can be downloaded from:

http://www.ibm.com/servers/eserver/support/unixservers/aixfixes.html

Security related Interim Fixes can be downloaded from:

ftp://aix.software.ibm.com/aix/efixes/security

VII. CONTACT INFORMATION

If you would like to receive AIX Security Advisories via email, please
visit:

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd

Comments regarding the content of this announcement can be directed to:

security-alert@austin.ibm.com

    To request the PGP public key that can be used to communicate
    securely with the AIX Security Team send email to
    security-alert@austin.ibm.com with a subject of "get key". The key
    can also be downloaded from a PGP Public Key Server. The key id is
    0x4265D862.

Please contact your local IBM AIX support center for any assistance.

    eServer is a trademark of International Business Machines Corporation.
    IBM, AIX and pSeries are registered trademarks of International Business
    Machines Corporation. All other trademarks are property of their
    respective holders.

VIII. ACKNOWLEDGMENTS

iDefense (http://labs.idefense.com/) credits an anonymous contributer.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (AIX)

iD8DBQFGoQNn0eNzcEJl2GIRAu32AJ9hpkSLqmDK3xneztNuFC4OqIIoNACgkQNU
Z4tR48e8kS2DKwupPgW13jk=
=wj14
-----END PGP SIGNATURE-----

---------------------------------------------------------------------

Related URLs:

Find end of support dates for AIX and software running on AIX
http://www.ibm.com/services/sl/products

Visit Unix Servers Support for a wide array of technical resources.
http://www.ibm.com/servers/eserver/support/unixservers

Download fixes for AIX V5 and 4.3 OS, Java, Compilers:
http://www-912.ibm.com/eserver/support/fixes/

Update your Subscription Service profile
http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoe?mode=2

Unsubscribe from Subscription Service
http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoe?mode=3

----------------------------------------------------------------------
IBM and AIX are trademarks or registered trademarks of the International Business Machines Corporation in the United States or other countries, or both.

AIX 5.3 : Security advisories (2007.07.26)

AIX pioinit File Replacement Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

IBM SECURITY ADVISORY

First Issued: Wed Jul 25 09:06:31 CDT 2007 ===============================================================================
VULNERABILITY SUMMARY

VULNERABILITY: AIX pioinit File Replacement Vulnerability

PLATFORMS: AIX 5.2, 5.3

SOLUTION: Apply the APAR, interim fix or workaround as described
below.

THREAT: An attacker may execute aribtrary code with root privileges.

CERT VU Number: n/a
CVE Number: n/a
===============================================================================
DETAILED INFORMATION

I. OVERVIEW

The pioinit script is run by root during platform boot to initialize the
printer services. This script is installed as user/group bin.

II. DESCRIPTION

    A local attacker in the bin group may execute arbitrary code with root
    privileges by installing their own copy of pioinit. This is due to the
    default file permissions and a lack of checking within the inittab script
    for a valid copy of the pioinit script.

III. IMPACT

A local attacker may run arbitrary code with root privileges.

IV. PLATFORM VULNERABILITY ASSESSMENT

To determine if your system is vulnerable, run the following command:

# lslpp -l | grep printers.rte

The following filesets are vulnerable:

    AIX Level           Lower Level       Upper Level
    -------------------------------------------------
    5.2.0               5.2.0.75          5.2.0.75
    5.3.0               5.3.0.30          5.3.0.30

NOTE: This vulnerability only pertains to AIX 5.2 TL08 and AIX 5.3 TL04.

V. SOLUTIONS

A. APARS

IBM provides the following fixes:

        AIX Level           APAR number       Availability
        --------------------------------------------------------------------
        5.2.0               IY79785           available
        5.3.0               IY79786           available

AIX Version 5 APARs can be downloaded from:

http://www.ibm.com/servers/eserver/support/unixservers/aixfixes.html

NOTE: Affected customers are urged to upgrade to the latest applicable
Technology Level and Service Pack.

B. INTERIM FIXES

Interim fixes are available. The interim fix can be downloaded via
ftp from:

ftp://aix.software.ibm.com/aix/efixes/security/pioinit_ifix.tar.Z

        AIX Release & Technology Level         Interim fix
        ---------------------------------------------------------------
        5200-08                                IY79785_08.070725.epkg.Z
        5300-04                                IY79786_04.070725.epkg.Z

        IMPORTANT: If possible, it is recommended that a mksysb backup of the
        system be created. Verify it is both bootable and readable before
        proceeding.

Verify you have retrieved the fixes intact:

        Filename                   sum        md5sum
        ----------------------------------------------------------------------
        IY79785_08.070725.epkg.Z   18066 4    f94d2261b31269cafe4218632e056edf
        IY79786_04.070725.epkg.Z   54968 4    ae0ae8ac5b1e8ae07ec20667835a029c

C. INTERIM FIX INSTALLATION

These packages use the new Interim Fix Management Solution to install
and manage interim fixes. More information can be found at:

http://www14.software.ibm.com/webapp/set2/sas/f/aix.efixmgmt/home.html

To preview an epkg interim fix installation execute the following
command:

# emgr -e ipkg_name -p # where ipkg_name is the name of the
# interim fix package being previewed.

To install an epkg interim fix package, execute the following command:

# emgr -e ipkg_name -X # where ipkg_name is the name of the
# interim fix package being installed.

The "X" flag will expand any filesystems if required.

VI. WORKAROUNDS

None.

VII. OBTAINING FIXES

AIX Version 5 APARs can be downloaded from:

http://www.ibm.com/servers/eserver/support/unixservers/aixfixes.html

Security related Interim Fixes can be downloaded from:

ftp://aix.software.ibm.com/aix/efixes/security

VII. CONTACT INFORMATION

If you would like to receive AIX Security Advisories via email, please
visit:

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd

Comments regarding the content of this announcement can be directed to:

security-alert@austin.ibm.com

Please contact your local IBM AIX support center for any assistance.

VIII. ACKNOWLEDGMENTS

This vulnerability was discovered internal to IBM as part of its
commitment to secure the AIX operating system.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (AIX)

iD8DBQFGqAl30eNzcEJl2GIRAh+mAKCyt9Jbld5nnvcY4RGAwcfWfxn9fQCfQPga
lXbA43jdlNjoFB24kmO4NcQ=
=3dDI
-----END PGP SIGNATURE-----

---------------------------------------------------------------------

Related URLs:

Find end of support dates for AIX and software running on AIX
http://www.ibm.com/services/sl/products

Visit Unix Servers Support for a wide array of technical resources.
http://www.ibm.com/servers/eserver/support/unixservers

Unsubscribe from Subscription Service
http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoe?mode=3

AIX 5.3 : Security advisories (2007.07.26)

AIX lpd Buffer Overflow Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

IBM SECURITY ADVISORY

First Issued: Tue Jul 24 18:09:11 CDT 2007 ===============================================================================
VULNERABILITY SUMMARY

VULNERABILITY: AIX lpd Buffer Overflow Vulnerability

PLATFORMS: AIX 5.2, 5.3

SOLUTION: Apply the APAR, interim fix or workaround as described
below.

THREAT: An attacker may run arbitrary code as root privileges.

CERT VU Number: n/a
CVE Number: n/a
===============================================================================
DETAILED INFORMATION

I. OVERVIEW

The 'lpd' command offers an interface to the remote print daemon (lpd).

II. DESCRIPTION

A buffer overflow vulnerability exists in the 'lpd' command which may allow
members of the printq group execute arbitrary code as root.

III. IMPACT

A local member of the printq may execute arbitrary code with root
privileges.

IV. PLATFORM VULNERABILITY ASSESSMENT

To determine if your system is vulnerable, run the following command:

# lslpp -l | grep bos.rte.printers

The following filesets are vulnerable:

    AIX Level           Lower Level       Upper Level
    -------------------------------------------------
    5.2.0               5.2.0.85          5.2.0.105
    5.3.0               5.3.0.40          5.3.0.60

V. SOLUTIONS

A. APARS

IBM provides the following fixes:

        AIX Level           APAR number       Availability
        --------------------------------------------------------------------
        5.2.0               IY98560           6/8/2007 (available)
        5.3.0               IY98339           6/8/2007 (available)

AIX Version 5 APARs can be downloaded from:

http://www.ibm.com/servers/eserver/support/unixservers/aixfixes.html

NOTE: Affected customers are urged to upgrade to the latest applicable
Technology Level and Service Pack.

B. INTERIM FIXES

Interim fixes are available. The interim fix can be downloaded via
ftp from:

ftp://aix.software.ibm.com/aix/efixes/security/lpd_ifix.tar.Z

        AIX Release & Technology Level         Interim fix
        ---------------------------------------------------------------
        5200-08                                IY98560_08.070724.epkg.Z
        5200-09                                IY98560_09.070724.epkg.Z
        5200-10                                IY98560_10.070724.epkg.Z
        5300-04                                IY98339_04.070724.epkg.Z
        5300-05                                IY98339_05.070724.epkg.Z
        5300-06                                IY98339_06.070724.epkg.Z

        IMPORTANT: If possible, it is recommended that a mksysb backup of the
        system be created. Verify it is both bootable and readable before
        proceeding.

Verify you have retrieved the fixes intact:

        Filename                   sum        md5sum
        ----------------------------------------------------------------------
        IY98560_08.070724.epkg.Z   12757 77   7e1b951bc46d5294bf4a2001b2250c21
        IY98560_09.070724.epkg.Z   64524 76   cfaa4502159825780678df5de0c084c6
        IY98560_10.070724.epkg.Z   34514 75   edc31f4b258285bc4feea841d66da3d7
        IY98339_04.070724.epkg.Z   01432 77   553ca3a541c28c65b23e99730b37e086
        IY98339_05.070724.epkg.Z   57125 76   dd5742c0d70c556fa3ed15d8a2d9c898
        IY98339_06.070724.epkg.Z   09692 77   39955f5773484160066243087561bd4d

C. INTERIM FIX INSTALLATION

These packages use the new Interim Fix Management Solution to install
and manage interim fixes. More information can be found at:

http://www14.software.ibm.com/webapp/set2/sas/f/aix.efixmgmt/home.html

To preview an epkg interim fix installation execute the following
command:

# emgr -e ipkg_name -p # where ipkg_name is the name of the
# interim fix package being previewed.

To install an epkg interim fix package, execute the following command:

# emgr -e ipkg_name -X # where ipkg_name is the name of the
# interim fix package being installed.

The "X" flag will expand any filesystems if required.

VI. WORKAROUNDS

A. OPTION 1

        Customers running AIX 5.3.0 TL06 may install the bos.rte.security
        fileset and take advantage of the 'fpm' command to disable the setuid
        capabilities of 'capture'. The 'capture' command is disabled in the
        high level database.

NOTE: This will disable functionality of the command for all users
except root.

NOTE: Some workarounds may disable function for some users.

VII. OBTAINING FIXES

AIX Version 5 APARs can be downloaded from:

http://www.ibm.com/servers/eserver/support/unixservers/aixfixes.html

Security related Interim Fixes can be downloaded from:

ftp://aix.software.ibm.com/aix/efixes/security

VII. CONTACT INFORMATION

If you would like to receive AIX Security Advisories via email, please
visit:

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd

Comments regarding the content of this announcement can be directed to:

security-alert@austin.ibm.com

Please contact your local IBM AIX support center for any assistance.

VIII. ACKNOWLEDGMENTS

This vulnerability was discovered internal to IBM as part of its
commitment to securing the AIX operating system.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (AIX)

iD8DBQFGpotz0eNzcEJl2GIRAvJcAJ94csxeK73XXAS2ojn+Do8f9hzcAgCfXK7z
fh5E/U6PfMZBqn/ShbeZNPA=
=9v5C
-----END PGP SIGNATURE-----

---------------------------------------------------------------------

Related URLs:

Find end of support dates for AIX and software running on AIX
http://www.ibm.com/services/sl/products

Visit Unix Servers Support for a wide array of technical resources.
http://www.ibm.com/servers/eserver/support/unixservers

Unsubscribe from Subscription Service
http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoe?mode=3

AIX 5.3 : Security advisories (2007.07.26)

AIX ftp gets() Buffer Overflow Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

IBM SECURITY ADVISORY

First Issued: Tue Jul 24 10:03:54 CDT 2007 ===============================================================================
VULNERABILITY SUMMARY

VULNERABILITY: AIX ftp gets() Buffer Overflow Vulnerabilities

PLATFORMS: AIX 5.2, 5.3

SOLUTION: Apply the APAR, interim fix or workaround as described
below.

THREAT: An attacker may run arbitrary code as root privileges.

CERT VU Number: n/a
CVE Number: n/a
===============================================================================
DETAILED INFORMATION

I. OVERVIEW

    The ftp command uses the File Transfer Protocol (FTP) to transfer files
    between the local host and a remote host or between two remote hosts. The
    program is installed by default and is setuid.

II. DESCRIPTION

    A local vulnerability exists in the client part of the ftp application
    whereby a user may execute arbitrary code with root privileges. This is
    due to calls to the deprecated routine 'gets()'.

III. IMPACT

The successful exploitation of this vulnerability allows a non-privileged
user to execute code with root privileges.

IV. PLATFORM VULNERABILITY ASSESSMENT

To determine if your system is vulnerable, run the following command:

# lslpp -l | grep bos.net.tcp.client

The following filesets are vulnerable:

    AIX Level           Lower Level       Upper Level
    -------------------------------------------------
    5.2.0               5.2.0.85          5.2.0.107
    5.3.0               5.3.0.40          5.3.0.62

V. SOLUTIONS

A. APARS

IBM provides the following fixes:

        AIX Level           APAR number       Availability
        --------------------------------------------------------------------
        5.2.0               IZ01812           10/31/2007 (subject to change)
        5.3.0               IZ01813           11/27/2007 (subject to change)

AIX Version 5 APARs can be downloaded from:

http://www.ibm.com/servers/eserver/support/unixservers/aixfixes.html

NOTE: Affected customers are urged to upgrade to the latest applicable
Technology Level and Service Pack.

B. INTERIM FIXES

Interim fixes are available. The interim fix can be downloaded via
ftp from:

ftp://aix.software.ibm.com/aix/efixes/security/ftpgets_ifix.tar.Z

        AIX Release & Technology Level         Interim fix
        ---------------------------------------------------------------
        5200-08                                IZ01812_08.070723.epkg.Z
        5200-09                                IZ01812_09.070723.epkg.Z
        5200-10                                IZ01812_10.070723.epkg.Z
        5300-04                                IZ01813_04.070723.epkg.Z
        5300-05                                IZ01813_05.070723.epkg.Z
        5300-06                                IZ01813_06.070723.epkg.Z

        IMPORTANT: If possible, it is recommended that a mksysb backup of the
        system be created. Verify it is both bootable and readable before
        proceeding.

Verify you have retrieved the fixes intact:

        Filename                   sum        md5sum
        ----------------------------------------------------------------------
        IZ01812_08.070723.epkg.Z   64692 123 a2f21e469e0b64a99455bd3ef0b86484
        IZ01812_09.070723.epkg.Z   18190 123 6a1e448cf3211bc5a323064d45bfb8eb
        IZ01812_10.070723.epkg.Z   45986 126 babccdd3a10113a3611995af8e49062c
        IZ01813_04.070723.epkg.Z   00288 126 bc0e7084191fd4672475bf4da9dfc494
        IZ01813_05.070723.epkg.Z   58925 126 dc83cce43dcb7654ab9d4f82b7b588f8
        IZ01813_06.070723.epkg.Z   36147 129 e0ee8317805a5120a64e72ae49522657

C. INTERIM FIX INSTALLATION

These packages use the new Interim Fix Management Solution to install
and manage interim fixes. More information can be found at:

http://www14.software.ibm.com/webapp/set2/sas/f/aix.efixmgmt/home.html

To preview an epkg interim fix installation execute the following
command:

# emgr -e ipkg_name -p # where ipkg_name is the name of the
# interim fix package being previewed.

To install an epkg interim fix package, execute the following command:

# emgr -e ipkg_name -X # where ipkg_name is the name of the
# interim fix package being installed.

The "X" flag will expand any filesystems if required.

VI. WORKAROUNDS

Due to the nature of ftp there are not many workarounds. If the program is
not necessary, the following options are available.

A. OPTION 1

Install openssl and openssh and take advantage of the secure copy 'scp'
command to transfer files between systems.

B. OPTION 2

Remove the setuid bit with the following command:

# chmod 555 /usr/bin/ftp

NOTE: This will effectively remove functionality from all users except
root.

VII. OBTAINING FIXES

AIX Version 5 APARs can be downloaded from:

http://www.ibm.com/servers/eserver/support/unixservers/aixfixes.html

Security related Interim Fixes can be downloaded from:

ftp://aix.software.ibm.com/aix/efixes/security

VII. CONTACT INFORMATION

If you would like to receive AIX Security Advisories via email, please
visit:

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd

Comments regarding the content of this announcement can be directed to:

security-alert@austin.ibm.com

Please contact your local IBM AIX support center for any assistance.

VIII. ACKNOWLEDGMENTS

iDefense (http://labs.idefense.com/) credits an anonymous contributer.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (AIX)

iD8DBQFGpoqv0eNzcEJl2GIRAvHzAKCxYKiLioNkessgDbn7gCfk8Bo4PACdELE5
PwSWMQfTwhCla5gwx6JYve0=
=FGGj
-----END PGP SIGNATURE-----

---------------------------------------------------------------------

Related URLs:

Find end of support dates for AIX and software running on AIX
http://www.ibm.com/services/sl/products

Visit Unix Servers Support for a wide array of technical resources.
http://www.ibm.com/servers/eserver/support/unixservers

Unsubscribe from Subscription Service
http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoe?mode=3

AIX 5.3 : Security advisories (2007.07.26)

AIX capture Terminal Control Sequence Stack Buffer Overflow Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

IBM SECURITY ADVISORY

First Issued: Mon Jul 23 16:13:01 CDT 2007 ===============================================================================
VULNERABILITY SUMMARY

VULNERABILITY: AIX capture Terminal Control Sequence Stack Buffer Overflow
Vulnerability

PLATFORMS: AIX 5.2, 5.3

SOLUTION: Apply the APAR, interim fix or workaround as described
below.

THREAT: An attacker may run arbitrary code as root privileges.

CERT VU Number: n/a
CVE Number: n/a
===============================================================================
DETAILED INFORMATION

I. OVERVIEW

    The capture command allows a user to dump everything printed on the
    user's terminal to a file. Capture is a setuid program installed by
    default.

II. DESCRIPTION

A buffer overflow vulnerability exists within the capture command, which
allows a local attacker to execute arbitrary code with root privileges.

III. IMPACT

The successful exploitation of this vulnerability allows a non-privileged
user to execute code with root privileges.

IV. PLATFORM VULNERABILITY ASSESSMENT

To determine if your system is vulnerable, run the following command:

# lslpp -l | grep bos.rte.shell

The following filesets are vulnerable:

    AIX Level           Lower Level       Upper Level
    -------------------------------------------------
    5.2.0               5.2.0.85          5.2.0.105
    5.3.0               5.3.0.40          5.3.0.61

    NOTE: IBM only supports the latest two releases (AIX 5.2 & 5.3) and the
    latest three Technology Levels (AIX 5.2 TL08, TL09, TL10 & AIX 5.3 TL04,
    TL05, TL06). Affected customers are urged to upgrade to the latest
    applicable Technology Level and Service Pack.

V. SOLUTIONS

A. APARS

IBM provides the following fixes:

        AIX Level           APAR number       Availability
        --------------------------------------------------------------------
        5.2.0               IZ01134           10/31/2007 (subject to change)
        5.3.0               IZ01135           11/27/2007 (subject to change)

AIX Version 5 APARs can be downloaded from:

http://www.ibm.com/servers/eserver/support/unixservers/aixfixes.html

NOTE: Affected customers are urged to upgrade to the latest applicable
Technology Level and Service Pack.

B. INTERIM FIXES

Interim fixes are available. The interim fix can be downloaded via
ftp from:

ftp://aix.software.ibm.com/aix/efixes/security/capture_ifix.tar.Z

        AIX Release & Technology Level         Interim fix
        ---------------------------------------------------------------
        5200-08                                IZ01135_08.070706.epkg.Z
        5200-09                                IZ01135_09.070706.epkg.Z
        5200-10                                IZ01135_10.070706.epkg.Z
        5300-04                                IZ01134_04.070706.epkg.Z
        5300-05                                IZ01134_05.070706.epkg.Z
        5300-06                                IZ01134_06.070706.epkg.Z

        IMPORTANT: If possible, it is recommended that a mksysb backup of the
        system be created. Verify it is both bootable and readable before
        proceeding.

Verify you have retrieved the fixes intact:

        Filename                   sum        md5sum
        ----------------------------------------------------------------------
        IZ01135_08.070706.epkg.Z   33065 17   359273b73c72b9ea4f7e0cb946229019
        IZ01135_09.070706.epkg.Z   32117 17   b588488fd4d3ab00947db2b703850261
        IZ01135_10.070706.epkg.Z   55625 17   89beccaa8a7c20c3e52feaca6a10956d
        IZ01134_04.070706.epkg.Z   31677 18   d5b31946b4abba3b086cb6e8b90b8144
        IZ01134_05.070706.epkg.Z   10938 18   7e2c7b7c2c82e7d53ce37d3c003f11e4
        IZ01134_06.070706.epkg.Z   30448 18   febbec7814c42d6a66409c5fd6124d7b

C. INTERIM FIX INSTALLATION

These packages use the new Interim Fix Management Solution to install
and manage interim fixes. More information can be found at:

http://www14.software.ibm.com/webapp/set2/sas/f/aix.efixmgmt/home.html

To preview an epkg interim fix installation execute the following
command:

# emgr -e ipkg_name -p # where ipkg_name is the name of the
# interim fix package being previewed.

To install an epkg interim fix package, execute the following command:

# emgr -e ipkg_name -X # where ipkg_name is the name of the
# interim fix package being installed.

The "X" flag will expand any filesystems if required.

VI. WORKAROUNDS

There are a couple of workarounds that may be implemented.

A. OPTION 1

If the program is unnecessary, it may be removed with the following
command:

# rm -f /usr/bin/capture

NOTE: To restore this command, the entire bos.rte.shell package must be
reinstalled.

B. OPTION 2

Change the permissions of this program to remove the setuid bit with
the following command:

#chmod 500 /usr/bin/capture

NOTE: This will disable functionality of the command for all users
except root.

C. OPTION 3

NOTE: This will disable functionality of the command for all users
except root.

VII. OBTAINING FIXES

AIX Version 5 APARs can be downloaded from:

http://www.ibm.com/servers/eserver/support/unixservers/aixfixes.html

Security related Interim Fixes can be downloaded from:

ftp://aix.software.ibm.com/aix/efixes/security

VII. CONTACT INFORMATION

If you would like to receive AIX Security Advisories via email, please
visit:

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd

Comments regarding the content of this announcement can be directed to:

security-alert@austin.ibm.com

Please contact your local IBM AIX support center for any assistance.

VIII. ACKNOWLEDGMENTS

iDefense (http://labs.idefense.com/) credits an anonymous contributer.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (AIX)

iD8DBQFGqLUI0eNzcEJl2GIRAjFdAJ9nFOECOUGGWsDm7pzTO1isDERq8QCgjlQM
i13m4GkTp1XgnCzlCU+xtc0=
=3zQ5
-----END PGP SIGNATURE-----

---------------------------------------------------------------------

Related URLs:

Find end of support dates for AIX and software running on AIX
http://www.ibm.com/services/sl/products

Visit Unix Servers Support for a wide array of technical resources.
http://www.ibm.com/servers/eserver/support/unixservers

Unsubscribe from Subscription Service
http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoe?mode=3

AIX 5.3 : Security advisories (2007.07.26)

AIX arp Buffer Overflow Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

IBM SECURITY ADVISORY

First Issued: Tue Jul 24 14:07:25 CDT 2007 ===============================================================================
VULNERABILITY SUMMARY

VULNERABILITY: AIX arp Buffer Overflow Vulnerability

PLATFORMS: AIX 5.2, 5.3

SOLUTION: Apply the APAR, interim fix or workaround as described
below.

THREAT: An attacker may run arbitrary code with root privileges.

CERT VU Number: n/a
CVE Number: n/a
===============================================================================
DETAILED INFORMATION

I. OVERVIEW

    The arp command displays and modifies the Internet-to-adapter address
    translation tables used by the Address in Networks and communication
    management. This program is installed as setuid with the
    devices.common.IBM.atm.rte fileset.

    NOTE: IBM has removed support for ATM functionality. This advisory is
    only to notify users that their system is vulnerable and to provide a patch
    for releases which are still delivering the fileset for legacy purposes.

II. DESCRIPTION

A buffer overflow vulnerability exits within the setuid program arp. This
advisory specifically addresses the atm subset of the arp command.

III. IMPACT

A successful exploitation of this buffer overflow will allow an
unprivileged user to execute arbitrary code with root privileges.

IV. PLATFORM VULNERABILITY ASSESSMENT

To determine if your system is vulnerable, run the following command:

# lslpp -l | grep devices.common.IBM.atm.rte

The following filesets are vulnerable:

    AIX Level           Lower Level       Upper Level
    -------------------------------------------------
    5.2.0               5.2.0.51          5.2.0.95
    5.3.0               5.3.0.40          5.3.0.60

V. SOLUTIONS

A. APARS

IBM provides the following fixes:

        AIX Level           APAR number       Availability
        --------------------------------------------------------------------
        5.2.0               IZ00521           10/31/2007 (subject to change)
        5.3.0               IZ00510           08/08/2007 (subject to change)

AIX Version 5 APARs can be downloaded from:

http://www.ibm.com/servers/eserver/support/unixservers/aixfixes.html

NOTE: Affected customers are urged to upgrade to the latest applicable
Technology Level and Service Pack.

B. INTERIM FIXES

Interim fixes are available. The interim fix can be downloaded via
ftp from:

ftp://aix.software.ibm.com/aix/efixes/security/atm_ifix.tar.Z

        AIX Release & Technology Level         Interim fix
        ---------------------------------------------------------------
        5200-08                                IZ00521_08.070622.epkg.Z
        5200-09                                IZ00521_09.070622.epkg.Z
        5200-10                                IZ00521_10.070622.epkg.Z
        5300-04                                IZ00510_04.070622.epkg.Z
        5300-05                                IZ00510_05.070622.epkg.Z
        5300-06                                IZ00510_06.070622.epkg.Z

        IMPORTANT: If possible, it is recommended that a mksysb backup of the
        system be created. Verify it is both bootable and readable before
        proceeding.

Verify you have retrieved the fixes intact:

        Filename                   sum        md5sum
        ----------------------------------------------------------------------
        IZ00521_08.070622.epkg.Z   19355 11   888d9ff0634cd3833c7b84adda724ef2
        IZ00521_09.070622.epkg.Z   22872 11   327f32bb81b4f7e03131ce2cc4fa25ce
        IZ00521_10.070622.epkg.Z   26138 11   636584044285fda77d308194b7988b7c
        IZ00510_04.070622.epkg.Z   15081 11   96e94ffc7ff68bacdc5d624cd6ddf7fe
        IZ00510_05.070622.epkg.Z   57550 11   db98e7b8f3c212857f89e9252d74967d
        IZ00510_06.070622.epkg.Z   46918 11   e490d017608db8e83c9a04d56f25b348

C. INTERIM FIX INSTALLATION

These packages use the new Interim Fix Management Solution to install
and manage interim fixes. More information can be found at:

http://www14.software.ibm.com/webapp/set2/sas/f/aix.efixmgmt/home.html

To preview an epkg interim fix installation execute the following
command:

# emgr -e ipkg_name -p # where ipkg_name is the name of the
# interim fix package being previewed.

To install an epkg interim fix package, execute the following command:

# emgr -e ipkg_name -X # where ipkg_name is the name of the
# interim fix package being installed.

The "X" flag will expand any filesystems if required.

VI. WORKAROUNDS

If the atm functionality is not needed on your platform, the best solution
is to remove the fileset listed above.

VII. OBTAINING FIXES

AIX Version 5 APARs can be downloaded from:

http://www.ibm.com/servers/eserver/support/unixservers/aixfixes.html

Security related Interim Fixes can be downloaded from:

ftp://aix.software.ibm.com/aix/efixes/security

VII. CONTACT INFORMATION

If you would like to receive AIX Security Advisories via email, please
visit:

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd

Comments regarding the content of this announcement can be directed to:

security-alert@austin.ibm.com

Please contact your local IBM AIX support center for any assistance.

VIII. ACKNOWLEDGMENTS

This vulnerability was discovered internal to IBM as part of its
commitment to secure the AIX operating system.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (AIX)

iD8DBQFGqAkN0eNzcEJl2GIRAkatAKCbJl8eEGhalyj/S6m0Egaa4TCuGQCfXY6q
c6ME0ZjCqWQ9XsDURDHeCzw=
=qG4w
-----END PGP SIGNATURE-----

---------------------------------------------------------------------

Related URLs:

Find end of support dates for AIX and software running on AIX
http://www.ibm.com/services/sl/products

Visit Unix Servers Support for a wide array of technical resources.
http://www.ibm.com/servers/eserver/support/unixservers

Unsubscribe from Subscription Service
http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoe?mode=3

This advisory contains information released by the original author. Some of the information may have changed since it was released. If the issue affects you, it may be prudent to retrieve the advisory from the site of the original source to ensure that you receive the most current information concerning that problem. Reference to any specific commercial product, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favouring by CPNI.

The views and opinions of authors expressed within this notice shall not be used for advertising or product endorsement purposes. CPNI shall not accept responsibility for any errors or omissions contained within this advisory. In particular, they shall not be liable for any loss or damage whatsoever, arising from or in connection with the usage of information contained within this advisory.

CSIRTUK is a member of the Forum of Incident Response and Security Teams (FIRST) and has contacts with other international Incident Response Teams (IRTs) in order to foster cooperation and coordination in incident prevention, to prompt rapid reaction to incidents, and to promote information sharing amongst its members and the community at large.