IBM

AIX sysback before 4.2.1.13 uses a relative path to find and execute the hostname program, which allows local users to gain privileges by modifying the path to point to a malicious hostname program.

OS2/Warp 4.5 FTP server allows remote attackers to cause a denial of service via a long username.

Buffer overflow in IBM Net.Data db2www CGI program allows remote attackers to execute arbitrary commands via a long PATH_INFO environmental variable.

AIX cdmount allows local users to gain root privileges via shell metacharacters.

Vulnerability in AIX 3.2.x and 4.x allows local users to gain write access to files on locally or remotely mounted AIX filesystems.

The AIX Fast Response Cache Accelerator (FRCA) allows local users to modify arbitrary files via the configuration capability in the frcactrl program.

Buffer overflow in portmir for AIX 4.3.0 allows local users to corrupt lock files and gain root privileges via the echo_error routine.

AIX techlibss allows local users to overwrite files via a symlink attack.

Unspecified vulnerability in crontab in IBM AIX 3.2 allows local users to gain root privileges via unknown attack vectors.

IBM WebSphere sets permissions that allow a local user to modify a deinstallation script or its data files stored in /usr/bin.

Denial of service in BIND named via malformed SIG records.

Denial of service in BIND named via naptr.

genfilt in the AIX Packet Filtering Module does not properly filter traffic to destination ports greater than 32767.

Buffer overflow in nslookup for AIX 4.3 allows local users to execute arbitrary code via a long hostname command line argument.

named-xfer in AIX 4.1.5 and 4.2.1 allows members of the system group to overwrite system files to gain root access via the -f parameter and a malformed zone file.

The ToolTalk ttsession daemon uses weak RPC authentication, which allows a remote attacker to execute commands.

Denial of service in AIX ptrace system call allows local users to crash the system.

Vulnerability in ptrace in AIX 4.3 allows local users to gain privileges by attaching to a setgid program.

The Lotus Notes 4.5 client may send a copy of encrypted mail in the clear across the network if the user does not set the "Encrypt Saved Mail" preference.

netstation.navio-com.rte 1.1.0.1 configuration script for Navio NC on IBM AIX exports /tmp over NFS as world-readable and world-writable.

IRIX and AIX automountd services (autofsd) allow remote users to execute root commands.

IBM/Tivoli OPC Tracker Agent version 2 release 1 creates files, directories, and IPC message queues with insecure permissions (world-readable and world-writable), which could allow local users to disrupt operations and possibly gain privileges by modifying or deleting files.

IBM/Tivoli OPC Tracker Agent version 2 release 1 allows remote attackers to cause a denial of service (resource exhaustion) via malformed data to the localtracker client port (5011), which prevents the connection from being closed properly.

Buffer overflow in the lex routines of nslookup for AIX 4.3 may allow attackers to cause a core dump and possibly execute arbitrary code via "long input strings."

(1) acledit and (2) aclput in AIX 4.3 allow local users to create or modify files via a symlink attack.

Buffer overflows in Sun libnsl allow root access.

Denial of Service vulnerability in BIND 8 Releases via maliciously formatted DNS messages.

inetd in AIX 4.1.5 dynamically assigns a port N when starting ttdbserver (ToolTalk server), but also inadvertently listens on port N-1 without passing control to ttdbserver, which allows remote attackers to cause a denial of service via a large number of connections to port N-1,…

sadc in IBM AIX 4.1 through 4.3, when called from programs such as timex that are setgid adm, allows local users to overwrite arbitrary files via a symlink attack.

Denial of service in AIX telnet can freeze a system and prevent users from accessing the server.

Vulnerability in digest in AIX 4.3 allows printq users to gain root privileges by creating and/or modifing any file on the system.

AIX routed allows remote users to modify sensitive files.

FTP servers can allow an attacker to connect to arbitrary ports on machines other than the FTP client, aka FTP bounce.

AIX piodmgrsu command allows local users to gain additional group privileges.

AIX nslookup command allows local users to obtain root access by not dropping privileges correctly.

The AIX FTP client can be forced to execute commands from a malicious server through shell metacharacters (e.g. a pipe character).

Buffer overflow in AIX writesrv command allows local users to obtain root access.

Buffer overflow in AIX libDtSvc library can allow local users to gain root access.

Buffer overflow in AIX xdat gives root access to local users.

Buffer overflow in AIX rcp command allows local users to obtain root access.

Lotus cc:Mail release 8 stores the postoffice password in plaintext in a hidden file which has insecure permissions, which allows local users to gain privileges.

DNS cache poisoning via BIND, by predictable query IDs.

An attacker can write to syslog files from any location, causing a denial of service by filling up the logs, and hiding activities.

The rwho/rwhod service is running, which exposes machine status and user information.

RIP v1 is susceptible to spoofing.

Command execution in Sun systems via buffer overflow in the at program.

Buffer overflow in xmcd 2.0p12 allows local users to gain access through an environmental variable.

Talkd, when given corrupt DNS information, can be used to execute arbitrary commands with root privileges.

Jolt ICMP attack causes a denial of service in Windows 95 and Windows NT systems.

Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file.