-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                          ESB-2008.0262 -- [AIX]
               AIX kernel multiple security vulnerabilities
                               27 March 2008

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              kernel
Publisher:            IBM
Operating System:     AIX
Impact:               Denial of Service
                      Inappropriate Access
Access:               Existing Account

Original Bulletin:    
http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4155

Revision History:     March 27 2008: AIX 6.1 APAR IZ13392 fixed in 
                                     bos.rte.tty 6.1.0.3
                      March 14 2008: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

IBM SECURITY ADVISORY

First Issued: Tue Mar 11 10:01:36 CDT 2008
| Updated: Wed Mar 26 11:24:13 CDT 2008
| AIX 6.1 APAR IZ13392 fixed in bos.rte.tty 6.1.0.3
===============================================================================
                           VULNERABILITY SUMMARY

VULNERABILITY:      AIX kernel multiple security vulnerabilities

PLATFORMS:          AIX 5.2, 5.3, 6.1

SOLUTION:           Apply the fix as described below.

THREAT:             An attacker may execute arbitrary code, cause a
                    denial of service, or access privileged data.

CVE Number:         n/a

Reboot required?    YES
Workarounds?        NO
Protected by FPM?   NO
Protected by SED?   NO
===============================================================================
                           DETAILED INFORMATION

I. DESCRIPTION

    There are multiple vulnerabilities in the AIX kernel:

    a) A 64-bit process that is restarted via the checkpoint and
    restart feature will gain read and write access to certain areas
    of kernel memory, resulting in execution of arbitrary
    code.
    Track with the following APAR numbers: IZ16992, IZ17111, IZ11820,
    IZ12794.  

    b) Remote nodes of a concurrent volume group may crash after a
    single node reduces the size of a JFS2 filesystem residing on the
    concurrent volume group, resulting in a denial of service.
    Track with the following APAR numbers: IZ05246, IZ04953, IZ04946.

    c) The proc filesystem does not enforce directory access controls
    correctly when the permission on a directory is more restrictive
    than permission on the currently executing file in that directory,
    resulting in information leakage.
    Track with the following APAR numbers: IZ06022, IZ06663, IZ06505.

    d) Trusted Execution fails to protect files when the modifications
    are made via hard links.  Affects AIX 6.1 only.
    Track with the following APAR number: IZ13418

    e) Some WPAR specific system calls may cause undefined behavior,
    possibly resulting in a denial of service.  Affects AIX 6.1 only.
    Track with the following APAR numbers: IZ13392, IZ13346

    f) A user with enough privileges to run ProbeVue can read from any
    kernel memory address, resulting in information leakage.  Affects
    AIX 6.1 only.
    Track with the following APAR number: IZ09545

    The following files are vulnerable:

    /usr/lib/boot/unix_64
    /usr/lib/boot/unix_mp
    /usr/lib/boot/unix_up
    /usr/lib/drivers/hd_pin
    /usr/sbin/lreducelv

    The fixes below include the fixes for all of the above APARs.

II. PLATFORM VULNERABILITY ASSESSMENT

    To determine if your system is vulnerable, execute the following
    command:

    lslpp -L bos.mp64 bos.mp bos.up bos.rte.lvm

    The following fileset levels are vulnerable:

    AIX Fileset        Lower Level       Upper Level
    ------------------------------------------------
    bos.mp64           5.2.0.85          5.2.0.89
    bos.mp64           5.2.0.95          5.2.0.102
    bos.mp64           5.2.0.105         5.2.0.110
    bos.mp64           5.3.0.50          5.3.0.57
    bos.mp64           5.3.0.60          5.3.0.66
    bos.mp64           5.3.7.0           5.3.7.2
    bos.mp64           6.1.0.0           6.1.0.3

    bos.mp             5.2.0.85          5.2.0.89
    bos.mp             5.2.0.95          5.2.0.102
    bos.mp             5.2.0.105         5.2.0.110
    bos.mp             5.3.0.50          5.3.0.57
    bos.mp             5.3.0.60          5.3.0.66
    bos.mp             5.3.7.0           5.3.7.2

    bos.rte.lvm        5.2.0.85          5.2.0.88
    bos.rte.lvm        5.2.0.95          5.2.0.99
    bos.rte.lvm        5.2.0.105         5.2.0.106
    bos.rte.lvm        5.3.0.50          5.3.0.55
    bos.rte.lvm        5.3.0.60          5.3.0.62
    bos.rte.lvm        5.3.7.0           5.3.7.0

|   bos.rte.tty        6.1.0.0           6.1.0.2

    bos.up             5.2.0.85          5.2.0.89
    bos.up             5.2.0.95          5.2.0.102
    bos.up             5.2.0.105         5.2.0.110

III. SOLUTIONS

    A. APARS

        IBM has assigned the following APARs to this problem:

        AIX Level           APAR number        Availability
        ---------------------------------------------------
        5.2.0               IZ16992            Now
        5.3.0               IZ17111            3/17/2008
        5.3.7               IZ11820            3/17/2008
        6.1.0               IZ12794            Now

        Subscribe to the APARs here:

        http://www.ibm.com/support/docview.wss?uid=isg1IZ16992
        http://www.ibm.com/support/docview.wss?uid=isg1IZ17111
        http://www.ibm.com/support/docview.wss?uid=isg1IZ11820
        http://www.ibm.com/support/docview.wss?uid=isg1IZ12794

        By subscribing, you will receive periodic email alerting you
        to the status of the APAR, and a link to download the fix once
        it becomes available.

    B. FIXES

        Fixes are available.  The fixes can be downloaded via ftp
        from:

        ftp://aix.software.ibm.com/aix/efixes/security/kernel_fix.tar

        The link above is to a tar file containing this signed
        advisory, fix packages, and PGP signatures for each package.
        The fixes below include prerequisite checking. This will
        enforce the correct mapping between the fixes and AIX
        Technology Levels.

        AIX Level          Fix (*.U) and Interim Fix (*.Z)
        -------------------------------------------------------------------
        5.2.0 TL8          IZ16992_8a.080306.epkg.Z
                           IZ16992_8b.080306.epkg.Z
                           IZ16992_8c.080306.epkg.Z
                           IZ16992_8d.080306.epkg.Z
        5.2.0 TL9          IZ16992_9a.080307.epkg.Z
                           IZ16992_9b.080306.epkg.Z
                           IZ16992_9c.080306.epkg.Z
                           IZ16992_9d.080306.epkg.Z
        5.2.0 TL10         bos.mp.5.2.0.111.U
                           bos.mp64.5.2.0.111.U
                           bos.up.5.2.0.111.U
                           bos.rte.lvm.5.2.0.107.U
        5.3.0 TL5          IZ17111_5a.080306.epkg.Z
                           IZ17111_5b.080306.epkg.Z
                           IZ17111_5c.080306.epkg.Z
                           IZ17111_5d.080306.epkg.Z
        5.3.0 TL6          IZ17111_6a.080306.epkg.Z
                           IZ17111_6b.080306.epkg.Z
                           bos.rte.lvm.5.3.0.64.U
        5.3.7              IZ11820_7a.080306.epkg.Z
                           IZ11820_7b.080306.epkg.Z
                           bos.rte.lvm.5.3.7.1.U
        6.1.0              bos.mp64.6.1.0.4.U
|                          bos.rte.tty.6.1.0.3.U

        To extract the fixes from the tar file:

        tar xvf kernel_fix.tar
        cd kernel_fix

        Verify you have retrieved the fixes intact:

        The checksums below were generated using the "sum", "cksum",
        "csum -h MD5" (md5sum), and "csum -h SHA1" (sha1sum) commands
        and are as follows:

        sum         filename
        ------------------------------------
        41878  5620 bos.mp.5.2.0.111.U
        12951  5975 bos.mp64.5.2.0.111.U
        51678 27683 bos.mp64.6.1.0.4.U
        48971  1989 bos.rte.lvm.5.2.0.107.U
        05910  2606 bos.rte.lvm.5.3.0.64.U
        65343  2788 bos.rte.lvm.5.3.7.1.U
|       13539   400 bos.rte.tty.6.1.0.3.U
        22827  5021 bos.up.5.2.0.111.U
        35484  5087 IZ11820_7a.080306.epkg.Z
        45602  4825 IZ11820_7b.080306.epkg.Z
        16407   113 IZ16992_8a.080306.epkg.Z
        11714  3708 IZ16992_8b.080306.epkg.Z
        50041  3588 IZ16992_8c.080306.epkg.Z
        46067  3349 IZ16992_8d.080306.epkg.Z
        49122   113 IZ16992_9a.080307.epkg.Z
        18653  3743 IZ16992_9b.080306.epkg.Z
        62615  3623 IZ16992_9c.080306.epkg.Z
        39339  3401 IZ16992_9d.080306.epkg.Z
        00170   118 IZ17111_5a.080306.epkg.Z
        08086    10 IZ17111_5b.080306.epkg.Z
        35123  4995 IZ17111_5c.080306.epkg.Z
        19037  4746 IZ17111_5d.080306.epkg.Z
        14321  5050 IZ17111_6a.080306.epkg.Z
        44698  4804 IZ17111_6b.080306.epkg.Z

        cksum              filename
        -------------------------------------------
        1769871756 5754880 bos.mp.5.2.0.111.U
        854968964 6118400 bos.mp64.5.2.0.111.U
        1292352585 28347392 bos.mp64.6.1.0.4.U
        3765659627 2036736 bos.rte.lvm.5.2.0.107.U
        4292727698 2668544 bos.rte.lvm.5.3.0.64.U
        656759935 2854912 bos.rte.lvm.5.3.7.1.U
|       1240743667 409600 bos.rte.tty.6.1.0.3.U
        760439356 5141504 bos.up.5.2.0.111.U
        2382658090 5208781 IZ11820_7a.080306.epkg.Z
        3885633244 4940563 IZ11820_7b.080306.epkg.Z
        2070295023 115495 IZ16992_8a.080306.epkg.Z
        735615564 3796809 IZ16992_8b.080306.epkg.Z
        611408700 3673977 IZ16992_8c.080306.epkg.Z
        2166905248 3428899 IZ16992_8d.080306.epkg.Z
        2170429470 115691 IZ16992_9a.080307.epkg.Z
        1014656148 3832647 IZ16992_9b.080306.epkg.Z
        3324704410 3709339 IZ16992_9c.080306.epkg.Z
        1795641163 3482555 IZ16992_9d.080306.epkg.Z
        3400540784 120191 IZ17111_5a.080306.epkg.Z
        2984586224 9775 IZ17111_5b.080306.epkg.Z
        3764592368 5114773 IZ17111_5c.080306.epkg.Z
        2456126235 4859115 IZ17111_5d.080306.epkg.Z
        222011986 5170787 IZ17111_6a.080306.epkg.Z
        2186942398 4919125 IZ17111_6b.080306.epkg.Z

        csum -h MD5 (md5sum)              filename
        ----------------------------------------------------------
        5186489f79b0afc131d411225a346999  bos.mp.5.2.0.111.U
        5352a3bd27bae5dca4e4e37ab99fbaae  bos.mp64.5.2.0.111.U
        71697c6d95aec28488744015419dc399  bos.mp64.6.1.0.4.U
        0c73aa8f0211c400455feaa6fb8a95c4  bos.rte.lvm.5.2.0.107.U
        2f8ad145066390e12e2252446a183944  bos.rte.lvm.5.3.0.64.U
        5924783e27116fc537e8f61b2275dddb  bos.rte.lvm.5.3.7.1.U
|       b98d3aa7d59ebd925f1cfaa9b35835dc  bos.rte.tty.6.1.0.3.U
        584b6e68e357061347ebba1cb02d1e44  bos.up.5.2.0.111.U
        3bdf0c6b42d51f464565d4b979065393  IZ11820_7a.080306.epkg.Z
        26fdf12c819265bb0cdce0706973b9bd  IZ11820_7b.080306.epkg.Z
        dd7dbdd27a20055252321c56a6a6350b  IZ16992_8a.080306.epkg.Z
        3c62749f4652ae0106d647244e21cfc1  IZ16992_8b.080306.epkg.Z
        a08adda9df1864ef6aba017e3c194797  IZ16992_8c.080306.epkg.Z
        f7ae9572cb6091232b916ec695bac6ac  IZ16992_8d.080306.epkg.Z
        27fd38800e29ad4b7ddc97bda9fedcc2  IZ16992_9a.080307.epkg.Z
        1944d6c2e00de4c755e5f0c08546db74  IZ16992_9b.080306.epkg.Z
        80ef4f2238bd6ee647ca89563f6d74da  IZ16992_9c.080306.epkg.Z
        7e28e491d2d2ba3e300603d10f511b8e  IZ16992_9d.080306.epkg.Z
        a5117f2b30ecf9b6a62c30cb4b5a9e7f  IZ17111_5a.080306.epkg.Z
        0dc97a5bcb07582db1c51ef5c714f245  IZ17111_5b.080306.epkg.Z
        f66821b93102a8521b7f4294549f1aa7  IZ17111_5c.080306.epkg.Z
        83a0b7b1002a28a8896be6209c9bda78  IZ17111_5d.080306.epkg.Z
        0209225b08a8ea140edcc49779856798  IZ17111_6a.080306.epkg.Z
        399a7cacd446a17d99dc07b2556a5017  IZ17111_6b.080306.epkg.Z

        csum -h SHA1 (sha1sum)                    filename
        ------------------------------------------------------------------
        06fef79ed1644e0781b729abc7ecb5f81f843e0c  bos.mp.5.2.0.111.U
        561fc6f66a74e44c02eaecf2d55930dc29027126  bos.mp64.5.2.0.111.U
        13904b26d77f4c38cc48dc4c44bfa45d39eaa2a0  bos.mp64.6.1.0.4.U
        4589a5bca998f437aac5c3bc2c222eaa51490dab  bos.rte.lvm.5.2.0.107.U
        1b6544f470ddb19fa84ca03bbdc6ff55216f8df7  bos.rte.lvm.5.3.0.64.U
        99bb3c53d7fca9cd0f9ae96e31c4d48ca4fb8bbe  bos.rte.lvm.5.3.7.1.U
|       465e264238eb1a4d218a1e85d8397d059d68d237  bos.rte.tty.6.1.0.3.U
        ed3724acab75a4e751c99b2f9a034196bef2dd27  bos.up.5.2.0.111.U
        f4dc336263da0fc500f0d7ab3de0e96e21baadf7  IZ11820_7a.080306.epkg.Z
        a893913e8ce82acc3490dd007aaa04c09c8ec5a0  IZ11820_7b.080306.epkg.Z
        1c766f2af50743f87673cef6a4e33ce8487c7e5c  IZ16992_8a.080306.epkg.Z
        85515b38a0ef970ebaea64a211e2eeb19e23d9d9  IZ16992_8b.080306.epkg.Z
        0d152cd131b0259fa1a7295ba33de25f2fe70bd0  IZ16992_8c.080306.epkg.Z
        99fc78dfc6cfbb522853b35173c6328e455be2d1  IZ16992_8d.080306.epkg.Z
        09f81efded8e5c6c96975e60e04b728c53656161  IZ16992_9a.080307.epkg.Z
        b22d6ba6e1ab6912ae3520a96ba4fa9188352671  IZ16992_9b.080306.epkg.Z
        f0d2a2466027ee312eedd02745c7b7a4f38a30fa  IZ16992_9c.080306.epkg.Z
        3aeb8ca3d0e55990f7b9d7f345a0729b641696b6  IZ16992_9d.080306.epkg.Z
        5db5eea7dcdf6d9eef6766d006d824cc5c7b6620  IZ17111_5a.080306.epkg.Z
        4cc96eff6aeaa48c5417a287c1ce84a3fb2a3a2d  IZ17111_5b.080306.epkg.Z
        b3a966360781db061dcfb268d8370e5b8b39d4e4  IZ17111_5c.080306.epkg.Z
        7e37864a3c19ef3a1c559d7ca03f9860734cc189  IZ17111_5d.080306.epkg.Z
        33ba9211e4206cf3c83945d823aa376c31863fe1  IZ17111_6a.080306.epkg.Z
        8acf7122a26620a6550b628474c07cba1bc07c0c  IZ17111_6b.080306.epkg.Z

        To verify the sums, use the text of this advisory as input to
        csum, md5sum, or sha1sum. For example:

        csum -h SHA1 -i Advisory.asc
        md5sum -c Advisory.asc
        sha1sum -c Advisory.asc

        These sums should match exactly. The PGP signatures in the tar
        file and on this advisory can also be used to verify the
        integrity of the fixes.  If the sums or signatures cannot be
        confirmed, contact IBM AIX Security at
        security-alert@austin.ibm.com and describe the discrepancy.

     C. FIX AND INTERIM FIX INSTALLATION

        IMPORTANT: If possible, it is recommended that a mksysb backup
        of the system be created.  Verify it is both bootable and
        readable before proceeding.

        To preview a fix installation:

        installp -a -d fix_name -p all  # where fix_name is the name of the
                                        # fix package being previewed.
        To install a fix package:

        installp -a -d fix_name -X all  # where fix_name is the name of the  
                                        # fix package being installed.

        Interim fixes have had limited functional and regression
        testing but not the full regression testing that takes place
        for Service Packs; thus, IBM does not warrant the fully
        correct functionality of an interim fix.

        Interim fix management documentation can be found at:

        http://www14.software.ibm.com/webapp/set2/sas/f/aix.efixmgmt/home.html

        To preview an interim fix installation:

        emgr -e ipkg_name -p         # where ipkg_name is the name of the  
                                     # interim fix package being previewed.

        To install an interim fix package:

        emgr -e ipkg_name -X         # where ipkg_name is the name of the  
                                     # interim fix package being installed.

IV. WORKAROUNDS

    There are no workarounds.

V. OBTAINING FIXES

    AIX security fixes can be downloaded from:

        ftp://aix.software.ibm.com/aix/efixes/security

    AIX fixes can be downloaded from:

        http://www.ibm.com/eserver/support/fixes/fixcentral/main/pseries/aix

    NOTE: Affected customers are urged to upgrade to the latest
    applicable Technology Level and Service Pack.

VI. CONTACT INFORMATION

    If you would like to receive AIX Security Advisories via email,
    please visit:

        http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd
 
    Comments regarding the content of this announcement can be
    directed to:

        security-alert@austin.ibm.com

    To request the PGP public key that can be used to communicate
    securely with the AIX Security Team you can either:

        A. Send an email with "get key" in the subject line to:

            security-alert@austin.ibm.com

        B. Download the key from a PGP Public Key Server. The key ID is:

            0xA6A36CCC

    Please contact your local IBM AIX support center for any
    assistance.

    eServer is a trademark of International Business Machines
    Corporation.  IBM, AIX and pSeries are registered trademarks of
    International Business Machines Corporation.  All other trademarks
    are property of their respective holders.

VII. ACKNOWLEDGMENTS

    IBM discovered and fixed this vulnerability as part of its
    commitment to secure the AIX operating system.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBR+r7ICh9+71yA2DNAQKCnAP8CzVjixADmvRFs0VCyYjgVNcYDDMh7Lu9
aB8zxzN+/6AsIxGcgXCDRHpo/xm0SiL4u5XWkqLHUeTStP0p1c2jsB5dsCej3Nn3
L4Y9u6M0z8Q0MH8t7oX3s4ctKtz4o/orf9G+uasgidYAOGLpof/ITmTv2g/Urrdv
L0pvPwv5EMY=
=7C5I
-----END PGP SIGNATURE-----