AIX

 View Only

  • 1.  New KSH vulnerability

    Posted Tue August 03, 2021 08:35 AM
    Security Bulletin: Vulnerability in ksh affects AIX (CVE-2021-29741)

    Anyone had any experience installing these fixes?

    ------------------------------
    Russell Adams
    ------------------------------


  • 2.  RE: New KSH vulnerability

    Posted Wed August 04, 2021 01:23 AM
    Edited by Chris Gibson Thu August 05, 2021 01:13 AM
    I've installed the fix without a problem. Haven't done any additional testing, but overall, seems to be working fine.

    ------------------------------
    CHRIS GIBSON
    ------------------------------

    Original Message


  • 3.  RE: New KSH vulnerability

    Posted Wed August 04, 2021 04:21 PM
    I had no issues installing the eFix, on my AIX 7.2 and VIO 3.1.2.21 boxes it was quite easy.

    ------------------------------
    David Graham
    ------------------------------

    Original Message


  • 4.  RE: New KSH vulnerability

    Posted Tue August 17, 2021 02:17 PM
    It worked fine. On IRC there had been some confusion over filenames.

    One important note is that the HTML advisory doesn't include where to find the signing key, while the text file advisory shipped with the efix does.

    If you had difficulty trying to check the signatures, refer to the Advisory.asc. The signature is at:

    ftp://ftp.software.ibm.com/systems/power/AIX/systems_p_os_aix_security_pubkey.txt

    However don't take my word for it, check the advisory.

    ------------------------------
    Russell Adams
    ------------------------------

    Original Message


  • 5.  RE: New KSH vulnerability

    Posted Thu August 19, 2021 01:37 AM
    Thanks for brining the Security Bulletin to AIX Digest.   It made me aware of the vulnerability so, I could work to roll it out to my environment.     
    Installation went smoothly for 7200-05-02.    No issues.  

    I am working to get it scheduled for the rest of my environment after it burns in for a week.

    Regards
    Robert

    ------------------------------
    Robert Gordon
    ------------------------------

    Original Message