This file contains summary information on AIX security alerts published
by the Computer Emergency Response Team (CERT), and the IBM Emergency
Response Team (ERS). The full text of these alerts can be obtained from
this mail server by requesting the 'CERT' and 'ERS' files. This
information (and more) is available from CERT and ERS directly on the
world-wide web at the following URLs:

  CERT: http://www.cert.org/

   ERS: http://www.ers.ibm.com/

In order to keep the size of this file reasonable, it contains only
advisories for the current year.. You can obtain a list of previous
advisories either from the above URLs, or by requesting one of the
"Security_YYYY" documents from this mail server.

The fixes mentioned in this document, when available, can be obtained
from Electronic Fix Distribution at the following URL:

  http://techsupport.services.ibm.com/server/fixes

The 'Security_APARs' document on this mail server contains a list of
security related APARs.
===============================================================================
===============================================================================
CERT Advisory CA-2002-11 Heap Overflow in Cachefs Daemon (cachefsd)

AIX is not vulnerable.
===============================================================================
===============================================================================
CERT Advisory CA-2002-10 Format String Vulnerability in rpc.rwalld

AIX 4.3 and 5.1 are not vulnerable.
===============================================================================
===============================================================================
CERT Advisory CA-2002-07 Double Free Bug in zlib Compression Library
(Updated 3/29/2002)

IBM's AIX operating system, version 5.1, ships with open
source-originated zlib that is used with the Redhat Package Manager
(rpm) to install applications that are included in the AIX-Linux
Affinity Toolkit. zlib (libz.a) is a shared library in AIX. AIX 5.1 is
susceptible to the described vulnerability. AIX 4.3.x does not ship
with zlib, but customers who install zlib and use it will be similarly
vulnerable.

An updated rpm.rte install image for AIX 5.1 can be obtained from:

 ftp://ftp.software.ibm.com/aix/freeSoftware/aixtoolbox/INSTALLP/ppc/

Customers that have installed zlib from the AIX-Linux Affinity Toolkit
CD can obtain an updated zlib RPM from:

 ftp://ftp.software.ibm.com/aix/freeSoftware/aixtoolbox/RPMS/ppc/zlib/
===============================================================================
===============================================================================
CERT Advisory CA-2002-06 Vulnerabilities in Various Implementations of the
                         RADIUS Protocol

AIX is not vulnerable.
===============================================================================
===============================================================================
CERT Advisory CA-2002-03: Multiple Vulnerabilities in Many
Implementations of the Simple Network Management Protocol (SNMP)

The AIX operating system is susceptible to the vulnerabilities
tested for by the Oulu University PROTOS test suite for all
levels of AIX 4.3.x prior to level 4.3.3.51, and AIX 5.1 prior
to level 5.1.0.10. APARs were developed and made available last
year that closed the vulnerabilities looked for by the test suite.
For 4.3.x, the relevant APAR is #IY17630; for 5.1, the appropriate
APAR is #IY20943.

To see if your version and level of AIX is vulnerable, enter the
command:

  lslpp -l bos.net.tcp.client

If the "Level" stated is lower than those given above, your
system is vulnerable, and you are urged to apply the appropriate
APAR.

AIX versions prior to 4.3 are also vulnerable, but these versions
are no longer supported by IBM.
===============================================================================
===============================================================================

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]