IBM Security Bulletin: Vulnerabilities in BIND affect AIX (CVE-2016-1285, CVE-2016-1286)

There are vulnerabilities in BIND that impact AIX.

CVE(s): CVE-2016-1285, CVE-2016-1286

Affected product(s) and affected version(s):

        AIX 5.3, 6.1, 7.1, 7.2
        VIOS 2.2.x

        The following fileset levels are vulnerable:
        
        key_fileset = aix

        Fileset                 Lower Level  Upper Level KEY 
        ---------------------------------------------------------
        bos.net.tcp.client      5.3.12.0     5.3.12.10   key_w_fs
        bos.net.tcp.server      5.3.12.0     5.3.12.6    key_w_fs
        bos.net.tcp.client      6.1.9.0      6.1.9.102   key_w_fs
        bos.net.tcp.server      6.1.9.0      6.1.9.101   key_w_fs
        bos.net.tcp.client      7.1.3.0      7.1.3.47    key_w_fs
        bos.net.tcp.server      7.1.3.0      7.1.3.47    key_w_fs
        bos.net.tcp.client      7.1.4.0      7.1.4.1     key_w_fs
        bos.net.tcp.server      7.1.4.0      7.1.4.1     key_w_fs
        bos.net.tcp.bind        7.2.0.0      7.2.0.0     key_w_fs
        bos.net.tcp.bind_utils  7.2.0.0      7.2.0.1     key_w_fs
        
        Note:  to find out whether the affected filesets are installed 
        on your systems, refer to the lslpp command found in AIX user's guide.

        Example:  lslpp -L | grep -i bos.net.tcp.client

Refer to the following reference URLs for remediation and additional vulnerability details:

Source Bulletin: http://http://aix.software.ibm.com/aix/efixes/security/bind_advisory12.asc

X-Force Database: http://ift.tt/1WhPh1c
http://ift.tt/1TnICjP

from IBM Product Security Incident Response Team http://ift.tt/28Lj5RC