Vulnerabilities > CVE-2010-1124 - Remote Denial of Service vulnerability in IBM AIX 'getaddrinfo()'

047910
CVSS 7.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
COMPLETE
network
low complexity
ibm
NVD
Published: 2010-03-26
Updated: 2010-03-29

Summary

bos.rte.libc 5.3.9.4 on IBM AIX 5.3 does not properly support reading a certain address field after a successful getaddrinfo function call, which allows context-dependent attackers to cause a denial of service (application crash) via unspecified vectors, as demonstrated by IBM DB2 crashes on "systems with databases cataloged with alternate servers using IP addresses."

Vulnerable Configurations

Part Description Count
OS
Ibm
2

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 38964 CVE ID: CVE-2010-1124 IBM AIX是一款商业性质的UNIX操作系统。 IBM AIX在执行getaddrinfo调用后bos.rte.libc不支持读取某些地址字段，用户受骗访问了恶意服务器IP地址就会导致拒绝服务。 IBM AIX 5.3 厂商补丁： IBM --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www-01.ibm.com/support/docview.wss?uid=isg1IZ66710
idSSV:19360
last seen2017-11-19
modified2010-03-30
published2010-03-30
reporterRoot
titleIBM AIX 5.3 getaddrinfo()函数远程拒绝服务漏洞

References