IBM Security Bulletin: Vulnerability in NTP affects AIX (CVE-2019-8936) Security Bulletin
There is a vulnerability in NTPv3 and NTPv4 that affects AIX.
CVE(s): CVE-2019-8936
Affected product(s) and affected version(s):
AIX 7.1, 7.2
VIOS 2.2, 3.1
The vulnerabilities in the following filesets are being addressed:
key_fileset = aix
For NTPv3: Fileset Lower Level Upper Level KEY PRODUCT(S)
———————————————————————
bos.net.tcp.client 6.1.9.0 6.1.9.404 key_w_fs NTPv3
bos.net.tcp.client 7.1.4.0 7.1.4.35 key_w_fs NTPv3
bos.net.tcp.client 7.1.5.0 7.1.5.33 key_w_fs NTPv3
bos.net.tcp.ntp 7.2.1.0 7.2.1.2 key_w_fs NTPv3
bos.net.tcp.ntpd 7.2.1.0 7.2.1.3 key_w_fs NTPv3
bos.net.tcp.ntp 7.2.2.0 7.2.2.17 key_w_fs NTPv3
bos.net.tcp.ntpd 7.2.2.0 7.2.2.17 key_w_fs NTPv3
bos.net.tcp.ntp 7.2.3.0 7.2.3.15 key_w_fs NTPv3
bos.net.tcp.ntpd 7.2.3.0 7.2.3.15 key_w_fs NTPv3
For NTPv4: Fileset Lower Level Upper Level KEY PRODUCT(S)
———————————————————————
ntp.rte 7.4.2.8100 7.4.2.8121 key_w_fs NTPv4
To find out whether the affected filesets are installed on your systems, refer to the lslpp command found in AIX user’s guide.
Example: lslpp -L | grep -i bos.net.tcp.client
Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: https://www-01.ibm.com/support/docview.wss?uid=ibm10961772
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/158926
The post IBM Security Bulletin: Vulnerability in NTP affects AIX (CVE-2019-8936) Security Bulletin appeared first on IBM PSIRT Blog.
from IBM Product Security Incident Response Team https://ift.tt/30iQqfv