Multiple vulnerabilities in IBM AIX
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 20 |
| CVE-ID | CVE-2017-1376 CVE-2017-1541 CVE-2017-10053 CVE-2017-10067 CVE-2017-10078 CVE-2017-10087 CVE-2017-10089 CVE-2017-10090 CVE-2017-10096 CVE-2017-10101 CVE-2017-10102 CVE-2017-10105 CVE-2017-10107 CVE-2017-10108 CVE-2017-10109 CVE-2017-10110 CVE-2017-10115 CVE-2017-10116 CVE-2017-10125 CVE-2017-10243 |
| CWE-ID | CWE-264 CWE-200 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
IBM AIX Operating systems & Components / Operating system |
| Vendor | IBM Corporation |
Security Bulletin
This security bulletin contains information about 20 vulnerabilities.
1) Privilege escalation
EUVDB-ID: #VU8079
Risk: Low
CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2017-1376
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain elevated privileges.
The weakness exists due to a flaw in the IBM J9 VM class verifier. A remote attacker can supply a specially crafted untrusted code to disable the security manager and escalate his privileges on the system.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Security restrictions bypass
EUVDB-ID: #VU8098
Risk: Low
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2017-1541
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass security restrictions.
The weakness exists due to a flaw in the AIX JRE/SDK installp and updatep packages. A remote attacker can supply specially crafted packages and prevent the java.security, java.policy and javaws.policy files from being updated correctly.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Denial of service
EUVDB-ID: #VU8097
Risk: Low
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2017-10053
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to unknown error. A remote attacker can cause the application to crash.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Privilege escalation
EUVDB-ID: #VU8096
Risk: Low
CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2017-10067
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote authenticated attacker to gain elevated privileges.
The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website and gain privileged access to the system.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Security restrictions bypass
EUVDB-ID: #VU8095
Risk: Low
CVSSv4.0: 8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2017-10078
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass security restrictions.
The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, bypass security restrictions and disclose and modify important data on the system.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Remote code execution
EUVDB-ID: #VU8094
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2017-10087
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, execute arbitrary code with elevated privileges and take full control over the system.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Remote code execution
EUVDB-ID: #VU8093
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2017-10089
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, execute arbitrary code with elevated privileges and take full control over the system.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Remote code execution
EUVDB-ID: #VU8092
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2017-10090
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, execute arbitrary code with elevated privileges and take full control over the system.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Remote code execution
EUVDB-ID: #VU8091
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2017-10096
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, execute arbitrary code with elevated privileges and take full control over the system.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Remote code execution
EUVDB-ID: #VU8090
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2017-10101
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, execute arbitrary code with elevated privileges and take full control over the system.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) Remote code execution
EUVDB-ID: #VU8089
Risk: High
CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2017-10102
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote authenticated attacker to execute arbitrary code.
The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, execute arbitrary code with elevated privileges and take full control over the system.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) Security restrictions bypass
EUVDB-ID: #VU8088
Risk: Medium
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2017-10105
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass security restrictions.
The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, bypass security restrictions and modify arbitrary data on the system.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
13) Remote code execution
EUVDB-ID: #VU8087
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2017-10107
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, execute arbitrary code with elevated privileges and take full control over the system.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
14) Denial of service
EUVDB-ID: #VU8086
Risk: Low
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2017-10108
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to unknown error. A remote attacker can cause the application to crash.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
15) Denial of service
EUVDB-ID: #VU8085
Risk: Low
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2017-10109
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to unknown error. A remote attacker can cause the application to crash.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
16) Remote code execution
EUVDB-ID: #VU8084
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2017-10110
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, execute arbitrary code with elevated privileges and take control over the affected system.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
17) Information disclosure
EUVDB-ID: #VU8083
Risk: Low
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2017-10115
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information.
The weakness exists due to unknown error. A remote attacker can disclose important data on the target system
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
18) Remote code execution
EUVDB-ID: #VU8082
Risk: High
CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2017-10116
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote authenticated attacker to execute arbitrary code.
The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted website, execute arbitrary code with elevated privileges and take full control over the system.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
19) Arbitrary code execution
EUVDB-ID: #VU8080
Risk: Medium
CVSSv4.0: 2 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2017-10125
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows an attacker with physical access to the system to execute arbitrary code on the target system.
The weakness exists due to unknown error. A remote attacker can execute arbitrary code with elevated privileges and compromise the vulnerable system.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
20) Information disclosure
EUVDB-ID: #VU8081
Risk: Low
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2017-10243
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information or cause DoS condition on the target system.
The weakness exists due to unknown error. A remote attacker can disclose arbitrary files or cause the application to crash.
Install update from vendor's website.
Vulnerable software versionsIBM AIX: 5.3 - 7.2
CPE2.3- cpe:2.3:o:ibm_corporation:ibm_aix:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:ibm_corporation:ibm_aix:7.1:*:*:*:*:*:*:*
https://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
