IBM Information for VU#538033

ypxfrd daemon fails to properly validate user supplied arguments in "getdbm" procedure

Status

Affected

Vendor Statement

The AIX operating system is vulnerable to the issue detailed above in the advisory. This affects AIX releases 4.3.3 and 5.1.0 An efix package for this issue will be available from the IBM software ftp site by 10/16/2002 at the latest. The package will be located at:

ftp://ftp.software.ibm.com/aix/efixes/security/ypserv_efix.tar.Z

The efix packages can be downloaded via anonymous ftp from ftp.software.ibm.com/aix/efixes/security.

This directory contains a README file that gives further details on the efix packages.

The APARs for this vulnerability are:

AIX 4.3.3: IY34800 ( available approx 10/16/2002 )
AIX 5.1.0: IY34664 ( currently available )

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Vendor References

None

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.