Advisories

CERT-In Advisory CIAD-2005-0013

Multiple Vulnerabilities in IBM AIX

Original Issue Date: June 23, 2005

Severity Rating: High

Systems Affected

IBM AIX 5.1, 5.2, 5.3

Overview

Multiple vulnerabilities have been found in IBM AIX Multiple Device Management Utilities. A local user with system group privileges may exploit a format string vulnerability by supplying specially crafted arguments containing format specifiers to gain root privileges .

Description

1. IBM AIX Multiple Device Management Utilities Local Format String Vulnerability

(a) IBM AIX chdev format string Vulnerability ( CAN-2005-0240 )

The 'chdev' program is a setuid root applications, embedded in IBM AIX operating system, that facilitates the changing of device characteristics. 'chdev' fails to properly use a formatted printing function. Local exploitation of a format string vulnerability in the chdev command could allow for arbitrary code execution as the root user

(b) IBM AIX auditselect command format string Vulnerability ( CAN-2005-0250 )

The auditselect program is a setuid root application, embedded in IBM AIX operating system, that selects audit records for analysis according to defined criteria. The auditselect command fails to properly use a formatted printing function.

2. Buffer Overflow Vulnerability in IBM AIX

(a) IBM AIX ipl_vayon Buffer Overflow Vulnerability ( CAN-2005-0262 )

The ipl_varyon program is a setuid root application, embedded in IBM AIX operation system, which can be used to set the default physical boot volume. IBM AIX version 5.2 and possibly other versions are vulnerable to a stack-based buffer overflow, caused by a vulnerability in the ipl_varyon command

(b) IBM AIX netpmon Buffer Overflow Vulnerability ( CAN-2005-0263 )

The netpmon program is a setuid root application, embedded in IBM AIX operating system, which can be used to monitor activity and report statistics on network I/O and network-related CPU usage. IBM AIX version 5.2 and possibly other versions are vulnerable to a stack based buffer overflow, in the netpmon command with -o option.

Solution

The vendor recommends setting the mode bits to "500" on the affected utility.Restrict membership to the audit group to trusted users.
IBM provudes following fixes:

http://www-1.ibm.com/support/docview.wss?uid=isg1IY67455
http://www-1.ibm.com/support/docview.wss?uid=isg1IY67519

Vendor Information
1
https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs?mode=1
2
ftp://aix.software.ibm.com/aix/efixes/security/nis_2_efix.tar.Z
3
https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs?mode=1&heading=AIX52&topic=SECURITY&month=ALL
4
https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs?mode=1&heading=AIX51&topic=SECURITY&month=ALL
5
https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs?mode=1&heading=AIX53&topic=SECURITY&month=ALL
6
http://www-1.ibm.com/support/docview.wss?rs=0&dc=DB550&q1=IY70034&uid=isg1IY70034&loc=en_US&cs=utf-8&lang=
7
http://www-1.ibm.com/support/docview.wss?rs=0&dc=DB550&q1=IY70032&uid=isg1IY70032&loc=en_US&cs=utf-8&lang=

References

iDEFENSE Security Advisory
http://www.idefense.com/application/poi/display?id=192&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=193&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=195&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=196&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=199&type=vulnerabilities

Secunia Security Advisory
http://secunia.com/advisories/14198
http://secunia.com/advisories/14856
http://secunia.com/advisories/14095

Security Tracker Alet
http://securitytracker.com/alerts/2005/Feb/1013103.html

US CERT Vulnerability Note
http://www.kb.cert.org/vuls/id/896729

Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in
Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India