PT-2013-4787 · Ibm+1 · Vios+2

Published 2013-07-16 · Updated 2017-09-19 · CVE-2013-4011

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM AIX versions 6.1 and 7.1 VIOS version 2.2.2.2-FP-26 SP-02

Description The issue involves multiple unspecified vulnerabilities in the InfiniBand subsystem, allowing local users to gain privileges. The vulnerabilities can be exploited through vectors involving arp.ib or ibstat.

Recommendations For IBM AIX versions 6.1 and 7.1, restrict access to the InfiniBand subsystem until a fix is available. For VIOS version 2.2.2.2-FP-26 SP-02, consider disabling the arp.ib and ibstat functions as a temporary workaround to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2013-4011

Affected Products

Ibm Aix

Infiniband

Vios

References · 19

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/aix/local/ibstat_path.rb · Exploit
• 🔥 https://exploit-db.com/exploits/32700 · Exploit
• 🔥 https://exploit-db.com/exploits/28507 · Exploit
• http://ibm.com/support/docview.wss?uid=isg1IV43580 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=isg1IV43582 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4011 · Security Note
• http://aix.software.ibm.com/aix/efixes/security/infiniband_advisory.asc · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=isg1IV43756 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=isg1IV43562 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=isg1IV43827 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=isg1IV43561 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/85617 · Note
• http://securityfocus.com/bid/61287 · Note
• http://osvdb.org/95420 · Note
• http://securitytracker.com/id/1028792 · Note