Security Bulletin: Vulnerabilities in NTP affect AIX (CVE-2016-7427, CVE-2016-7428, CVE-2016-9310, CVE-2016-9311)

There are multiple vulnerabilities in NTPv3 and NTPv4 that impact AIX.

CVE(s):CVE-2016-7427, CVE-2016-7428, CVE-2016-9310, CVE-2016-9311

Affected product(s) and affected version(s):

 AIX 6.1, 7.1, 7.2
The following fileset levels are vulnerable:
key_fileset = aix
For NTPv3:
Fileset Lower Level Upper Level KEY
-----------------------------------------------------
bos.net.tcp.client 6.1.9.0 6.1.9.200 key_w_fs
bos.net.tcp.client 7.1.4.0 7.1.4.30 key_w_fs
bos.net.tcp.ntp 7.2.0.0 7.2.0.2 key_w_fs
bos.net.tcp.ntpd 7.2.0.0 7.2.0.2 key_w_fs
For NTPv4:
Fileset Lower Level Upper Level KEY -----------------------------------------------------
ntp.rte 6.1.6.0 6.1.6.7 key_w_fs
ntp.rte 7.1.0.0 7.1.0.7 key_w_fs Note: To find out whether the affected filesets are installed on your systems, refer to the lslpp command found in AIX user's
guide.
Example: lslpp -L | grep -i ntp.rte 

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/2kPZmHe
X-Force Database: http://ift.tt/2kK60ME
http://ift.tt/2kq8vr6
http://ift.tt/2kKanal
http://ift.tt/2kq1bM6

The post Security Bulletin: Vulnerabilities in NTP affect AIX (CVE-2016-7427, CVE-2016-7428, CVE-2016-9310, CVE-2016-9311) appeared first on IBM PSIRT Blog.

from IBM Product Security Incident Response Team http://ift.tt/2kJOrwg