ID CVE-2009-3516
Summary gssd in IBM AIX 5.3.x through 5.3.9 and 6.1.0 through 6.1.2 does not properly handle the NFSv4 Kerberos credential cache, which allows local users to bypass intended access restrictions for Kerberized NFSv4 shares via unspecified vectors.
References
Vulnerable Configurations
  • IBM AIX 5.3.8
    cpe:2.3:o:ibm:aix:5.3.8
  • IBM AIX 5.3.7
    cpe:2.3:o:ibm:aix:5.3.7
  • IBM AIX 5.3.0
    cpe:2.3:o:ibm:aix:5.3.0
  • IBM AIX 6.1
    cpe:2.3:o:ibm:aix:6.1
  • IBM AIX 6.1.0
    cpe:2.3:o:ibm:aix:6.1.0
  • IBM AIX 6.1.1
    cpe:2.3:o:ibm:aix:6.1.1
  • IBM AIX 6.1.2
    cpe:2.3:o:ibm:aix:6.1.2
CVSS
Base: 7.2 (as of 02-10-2009 - 10:44)
Impact:
Exploitability:
CWE CWE-255
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
nessus via4
  • NASL family AIX Local Security Checks
    NASL id AIX_U825042.NASL
    description The remote host is missing AIX PTF U825042, which is related to the security of the package bos.net.nfs.client.
    last seen 2019-02-21
    modified 2013-03-14
    plugin id 39637
    published 2009-07-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=39637
    title AIX 5.3 TL 7 : bos.net.nfs.client (U825042)
  • NASL family AIX Local Security Checks
    NASL id AIX_U823931.NASL
    description The remote host is missing AIX PTF U823931, which is related to the security of the package bos.net.nfs.client.
    last seen 2019-02-21
    modified 2013-03-14
    plugin id 39079
    published 2009-06-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=39079
    title AIX 6.1 TL 1 : bos.net.nfs.client (U823931)
  • NASL family AIX Local Security Checks
    NASL id AIX_U823848.NASL
    description The remote host is missing AIX PTF U823848, which is related to the security of the package bos.net.nfs.client.
    last seen 2019-02-21
    modified 2013-03-14
    plugin id 39026
    published 2009-06-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=39026
    title AIX 6.1 : bos.net.nfs.client (U823848)
  • NASL family AIX Local Security Checks
    NASL id AIX_U825103.NASL
    description The remote host is missing AIX PTF U825103, which is related to the security of the package bos.net.nfs.client.
    last seen 2019-02-21
    modified 2013-03-14
    plugin id 39666
    published 2009-07-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=39666
    title AIX 5.3 TL 8 : bos.net.nfs.client (U825103)
  • NASL family AIX Local Security Checks
    NASL id AIX_U824054.NASL
    description The remote host is missing AIX PTF U824054, which is related to the security of the package bos.net.nfs.client.
    last seen 2019-02-21
    modified 2013-03-14
    plugin id 39136
    published 2009-06-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=39136
    title AIX 6.1 TL 2 : bos.net.nfs.client (U824054)
  • NASL family AIX Local Security Checks
    NASL id AIX_U825202.NASL
    description The remote host is missing AIX PTF U825202, which is related to the security of the package bos.net.nfs.client.
    last seen 2019-02-21
    modified 2013-03-14
    plugin id 39706
    published 2009-07-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=39706
    title AIX 5.3 TL 9 : bos.net.nfs.client (U825202)
oval via4
accepted 2009-11-30T04:00:32.911-05:00
class vulnerability
contributors
name Pai Peng
organization Hewlett-Packard
definition_extensions
  • comment IBM AIX 5300-07 is installed
    oval oval:org.mitre.oval:def:5707
  • comment IBM AIX 5300-08 is installed
    oval oval:org.mitre.oval:def:5293
  • comment IBM AIX 5300-09 is installed
    oval oval:org.mitre.oval:def:6306
  • comment IBM AIX 6100-00 is installed
    oval oval:org.mitre.oval:def:5589
  • comment IBM AIX 6100-01 is installed
    oval oval:org.mitre.oval:def:5959
  • comment IBM AIX 6100-02 is installed
    oval oval:org.mitre.oval:def:5685
description gssd in IBM AIX 5.3.x through 5.3.9 and 6.1.0 through 6.1.2 does not properly handle the NFSv4 Kerberos credential cache, which allows local users to bypass intended access restrictions for Kerberized NFSv4 shares via unspecified vectors.
family unix
id oval:org.mitre.oval:def:6318
status accepted
submitted 2009-10-09T14:55:01.000-04:00
title AIX NFSv4 Kerberos vulnerability
version 40
refmap via4
aixapar
  • IZ49024
  • IZ49096
  • IZ49278
  • IZ50399
  • IZ50444
  • IZ50496
bid 36545
confirm http://aix.software.ibm.com/aix/efixes/security/nfs4_advisory.asc
vupen ADV-2009-2788
Last major update 21-08-2010 - 01:35
Published 01-10-2009 - 11:30
Last modified 18-09-2017 - 21:29
Back to Top