Christer Oberg

**Name of the Vulnerable Software and Affected Versions** IBM AIX versions 7.1 through 7.3 VIOS version 3.1 **Description** The issue is related to insufficient access control in the IBM AIX kernel, allowing a non-privileged local user to exploit the vulnerability and obtain root privileges, potentially enabling the execution of arbitrary code. **Recommendations** For IBM AIX versions 7.1 through 7.3, update to a version that includes the fix for this issue. For VIOS version 3.1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the kernel to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** IBM AIX versions 7.1 through 7.3 VIOS version 3.1 **Description** A vulnerability exists in the invscout command that could allow a non-privileged local user to obtain root privileges. **Recommendations** For IBM AIX versions 7.1 through 7.3, consider restricting access to the invscout command until a fix is available. For VIOS version 3.1, consider restricting access to the invscout command until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenServer versions 5.0.6 through 5.0.7 **Description** The issue allows local users to gain privileges through crafted strings on the command line in the scosession program. **Recommendations** For OpenServer versions 5.0.6 and 5.0.7, at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: FreeBSD versions 5.x Description: The issue allows local users to read arbitrary kernel memory. This can be achieved through the syscons CONS SCRSHOT ioctl by using either negative coordinates or large coordinates. Recommendations: For FreeBSD version 5.x, consider restricting access to the syscons CONS SCRSHOT ioctl until a patch is available. As a temporary workaround, avoid using the CONS SCRSHOT ioctl with negative or large coordinates to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenBSD versions 3.5 and earlier **Description** The issue is related to multiple integer overflows in several procfs files for OpenBSD, including `procfs cmdline.c`, `procfs fpregs.c`, `procfs linux.c`, `procfs regs.c`, `procfs status.c`, and `procfs subr.c`. This allows local users to read sensitive kernel memory and possibly perform other unauthorized activities. **Recommendations** For OpenBSD versions 3.5 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SCO UnixWare versions 7.1.1, 7.1.3 Open UNIX version 8.0.0 **Description** The issue allows local users to bypass protections for the address space file for a process ID by obtaining a procfs file descriptor for the file and calling execve() on a setuid or setgid program. This leaves the descriptor open to the user, potentially leading to unauthorized access. **Recommendations** For SCO UnixWare versions 7.1.1 and 7.1.3, consider restricting access to setuid and setgid programs to minimize the risk of exploitation. For Open UNIX version 8.0.0, restrict access to the procfs file descriptor to prevent unauthorized users from obtaining it. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** thttpd versions 2.21 through 2.23b1 **Description** A buffer overflow issue exists in the defang function within libhttpd.c, allowing remote attackers to execute arbitrary code. This occurs when requests containing '<' or '>' characters are processed, triggering the overflow as these characters are expanded into "&lt;" and "&gt;" sequences. **Recommendations** For thttpd versions 2.21 through 2.23b1, as a temporary workaround, consider restricting access to the defang function in libhttpd.c until a patch is available.