Just a quick note since I hear of people running into this issue all the time.

I’m unsure if this is an HBA firmware issue, or if it ‘works as expected’, but when plugging a Fiber cable into an HBA while it’s attached to an LPAR, you will not get a link immediately. Actually, this isn’t even LPAR specific, I have had this happen with physical systems as well.
From past experiences, you’ll have to rmdev -dl the fcs0,fcnet0,fscsi0,etc and run cfgmgr to bring the device back in. This seems to perform some sort of virtual power off/on type of situation, then will reconfigure the device and it will have a link. I’m not sure if this is just the environment I’m working with or not, but it happens every time a cable is plugged in while the system is live!

mksysb’s can come in handy for various situations. Whether you’re doing an upgrade, or just wanting a backup of a system, I definitely recommend using the mksysb command.
Creating a mksysb is a very simple process. First you need to make sure you have enough space free to dump it to, then just kick it off.

I generally run something like:

"mksysb -iep /mksysb_dump.mksysb

I generally create an NFS share from the NIM server, and mount it up on each AIX client in order to dump a weekly mksysb. The overall process actually ssh’s to the remote AIX client, mounts the NFS share, dumps a mksysb, compresses, umount, done.

With having issues in the past using the software compression within the mksysb process, I generally use the -p flag to disable software compression, and gzip at a later time. With a very busy rootvg, you will probably most likely have to disable compression, as you will likely run into issues restoring it.
Have fun.

Just a very brief how to on the patching.
You can download the TL8 patch set from the following URL: http://www-933.ibm.com/eserver/support/fixes/fixcentral/pfixpacks/53

First you’ll generally want to commit all existing filesets in cases there are any issues with TL8, so you can back out more easily.
The following will commit all previously applied filesets:
/usr/lib/instl/sm_inst installp_cmd -c -f'all' '-g' '-X' '-V2'

Transfer the patch cluster to your server and decompress. Once that’s complete, run the following to preview the process:

/usr/sbin/install_all_updates -d -p -V -Y

Verify that everything looks good, then continue with:
/usr/sbin/install_all_updates -d -V -Y
Sit back and wait… Once complete, it would generally be a good idea to run through errpt, as well as a reboot then check it out again. Watch the console on boot for any odd boot messages or errors starting any services.

Verify the patching by checking the oslevel:
oslevel -s

While doing some 5.0MP1 upgrades recently, I noticed that MPIO no longer controlled my vscsi root disks, coming from a Virtual I/O server. This was definitely not what I wanted. After a few calls and a few hours on the phone, I was finally told that MP1 finally had support for vscsi devices within Veritas, hence DMP taking control for multi-pathing. Due to the way I use vscsi devices for root disks, we had to disable this support. vscsi disks will still work through Veritas, they just use the standard ‘aixdisk’ format, rather than vscsi. To disable vscsi support I had to run the following
‘/usr/lib/vxvm/bin/vxdmpvscsi disable’, then reboot

Once the LPAR boot back up, everything was good to go. Existing volumes using vscsi devices continued to function.

The good: You can disable it
The bad: There’s no way to disable it before applying MP1… ugh.

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4219

Readme file updated for PTF U814685 for HMC Version 3 Release 3.3.7)
Description:

The readme file for PTF U814685 stated to install PTF U809968. However, since PTF U810401 supersedes PTF U809968, the readme file has been updated.

After installing PTF U814685, PTFs U808917 and U810401 must be installed.

In addition, the PTF U810401 readme file has been updated to state that it supersedes PTF U809968.

Note: PTF U809968 has been removed from the web.

View the U814685 Readme file for fix and enhancement information.

View the U810401 Readme file for fix and enhancement information.

Visit Hardware Management Console for all the latest updates.

http://www.ibm.com/support/docview.wss?uid=isg1IZ17881

High Impact/Highly Pervasive APAR

APAR Number: IZ17881

——————————————————————————–

APAR status
Closed as program error.

Error description
Sockets may not get freed if an application is using the
pollset APIs to poll on the sockets. This may cause the
memory leak (i.e. memory usage slowly increasing) until
the system becomes very sluggish or even hangs. The problem
has been seen when running a DB2 v9.1 client.
Local fix
Problem summary
****************************************************************
* USERS AFFECTED:
* Users of AIX 6.1 with the bos.mp64 fileset below the leve of
* 6.1.0.5.
****************************************************************
* PROBLEM DESCRIPTION:
* Sockets may not get freed if an application is using the
* pollset APIs to poll on the sockets. This may cause the
* memory leak (i.e. memory usage slowly increasing) until
* the system becomes very sluggish or even hangs. The problem
* has been seen when running a DB2 v9.1 client.
****************************************************************
* RECOMMENDAION:
* Install APAR IZ17881.
****************************************************************
Problem conclusion
AIX kernel was fixed to correctly manage the socket
reference count along the pollset API paths such that the
sockets can be freed after they are closed. Freeing the
sockets ensures that the memory is returned to AIX and is
not leaked.
Temporary fix
*********
* HIPER *
*********

Comments
APAR information
APAR number IZ17881
Reported component name AIX 610
Reported component ID 5765G6200
Reported release 610
Status CLOSED PER
PE NoPE
HIPER YesHIPER
Submitted date 2008-03-15
Closed date 2008-03-15
Last modified date 2008-04-07

APAR is sysrouted FROM one or more of the following:
IZ17873

APAR is sysrouted TO one or more of the following:

Fix information
Fixed component name AIX 610
Fixed component ID 5765G6200

Applicable component levels
R610 PSY U816201 UP08/04/07 I 1000

http://www.ibm.com/support/docview.wss?uid=isg1IZ17558

On very loaded systems, this may not give the gsclvmd
process enough time to respond to the check, resulting in
the VG being forced offline during times of heavy system
load.
Customers could see, in the errpt, LVM_GS_LLEAVE
followed by LVM_SA_QUORCLOSE on the node where the VG was
forced offline, and see LVM_GS_RLEAVE on other nodes
in the cluster.
.
.
A related issue is: when an LVM configuration or stale
partition update happens in a concurrent VG, gsclvmd must
get approval from every node before making the change.
In doing so, currently gsclmvd will wait forever until
all remote nodes respond in some fashion.
.
Under certain problematic conditions, this behavior is
undesirable and can cause the LVM commands to wait
indefinitely.
Local fix
Problem summary
****************************************************************
* USERS AFFECTED:
* Customers may be exposed to this problem if the have the
* bos.clvm.enh fileset at a level below 6.1.0.2.
* They must also be using Concurrent LVM, which is utilized by
* HACMP Resource Groups using Fast Disk Takeover or the ‘Online
* on All Available Notes’ Startup Policy.
****************************************************************

* PROBLEM DESCRIPTION:
* On extremely busy clusters, or clusters experiencing poor
* network communication, the concurrent LVM daemon (gsclvmd) on
* a node may fail to respond to a responsiveness check issued by
* Group Services. In this case, we will force the Volume Group
* offline on that node to ensure there is no possibility that
* future LVM configuration changes will cause the Volume Group
* definition to become out of sync between the two nodes.
* However, forcing the VG offline could lead to unexpected
* downtime of applications using that volume group, or potential
* problems during HACMP failover.
****************************************************************
* RECOMMENDATION:
* Install APAR IZ17558.
****************************************************************
Problem conclusion
Both of the behaviors of gsclvmd described above will be
changed.
.
By default, we will no longer expel a node and force it’s
VG offline if it fails a responsiveness check.
A flag will be added to varyonvg that will allow you to
enable this behavior (expeling non responsive nodes) if
desired.
.
Also, if a node takes longer than 5 minutes to reply to
a vote (taken before making an LVM configuration change
or stale partition update on a concurrent VG), then we
will expel that node and the VG on that node will be
forced offline. You will see LVM_GS_CFGTIME followed
by LVM_GS_LLEAVE or LVM_GS_RLEAVE in the errpt if this
happens.
.
.
*Note: due to the changes in the default behavior of
gsclvmd, this apar needs to be applied to all nodes in
the cluster. If not, there may be problems if ever
a node is un-responsive to either a responsiveness
check or a vote request.
Temporary fix
*********
* HIPER *
*********
Comments
APAR information
APAR number IZ17558
Reported component name AIX 610
Reported component ID 5765G6200
Reported release 610
Status CLOSED PER
PE NoPE
HIPER YesHIPER
Submitted date 2008-03-11
Closed date 2008-03-11
Last modified date 2008-04-07

APAR is sysrouted FROM one or more of the following:
IZ13557

APAR is sysrouted TO one or more of the following:
U817458

Fix information
Fixed component name AIX 610
Fixed component ID 5765G6200

Applicable component levels
R610 PSY U817458 UP08/04/07 I 1000

1) AIX 6.1 : High impact/highly pervasive (2008.04.08)

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4194#IZ17742

APAR Number: IZ17742
On systems with devices.fcp.disk.rte greater than
5.3.0.63,
the system may crash with a large stack traceback. The
stack traceback may look similar to the following:

# kdb
(2)> f
pvthread+0E5B00 STACK:
[000784D4]xmemdma64_list+000078 (0000000000000000,
F1000100CC565000, 0000000000020000, F1000100472ED608,
0000000000000001, 000000000000000E [??])
[03F31E18]d_map_list_tce+0005F0 (??, ??, ??, ??, ??)
[03FB1EC4]efc_mapdma_iocb+0005BC (??, ??)
[03FB830C]efc_start+0004E4 (??)
[03FB8EC4]efc_output+0004E0 (??, ??)
[03FFD59C]efsc_start+001050 (??, ??)
[04001878]efsc_strategy+00297C (??)
[000EEAE8]std_devstrat+000270 (??)
[000EEE94]devstrat@AF13_6+000058 (??)
[0404F000]scsidisk_start+001AE4 (??)
[04051504]scsidisk_strategy+000578 (??)
[000EEAE8]std_devstrat+000270 (??)
…
…

(2)> dr iar
iar : 00000000000784D4
.xmemdma64_list+000078 stdu stkp,FFFFFE60(stkp)
stkp=F0000000300140D0,FFFFFE60(stkp)=F000000030013F30

The system crashes while manipulating the stack pointer.

UPDATE AIX kernel multiple security vulnerabilities

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

IBM SECURITY ADVISORY

First Issued: Tue Mar 11 10:01:36 CDT 2008
| Updated: Wed Mar 26 11:24:13 CDT 2008
| AIX 6.1 APAR IZ13392 fixed in bos.rte.tty 6.1.0.3
===============================================================================
VULNERABILITY SUMMARY

VULNERABILITY: AIX kernel multiple security vulnerabilities

PLATFORMS: AIX 5.2, 5.3, 6.1

SOLUTION: Apply the fix as described below.

THREAT: An attacker may execute arbitrary code, cause a
denial of service, or access privileged data.

CVE Number: n/a

Reboot required? YES
Workarounds? NO
Protected by FPM? NO
Protected by SED? NO
===============================================================================
DETAILED INFORMATION

I. DESCRIPTION

There are multiple vulnerabilities in the AIX kernel:

a) A 64-bit process that is restarted via the checkpoint and
restart feature will gain read and write access to certain areas
of kernel memory, resulting in execution of arbitrary
code.
Track with the following APAR numbers: IZ16992, IZ17111, IZ11820,
IZ12794.

b) Remote nodes of a concurrent volume group may crash after a
single node reduces the size of a JFS2 filesystem residing on the
concurrent volume group, resulting in a denial of service.
Track with the following APAR numbers: IZ05246, IZ04953, IZ04946.

c) The proc filesystem does not enforce directory access controls
correctly when the permission on a directory is more restrictive
than permission on the currently executing file in that directory,
resulting in information leakage.
Track with the following APAR numbers: IZ06022, IZ06663, IZ06505.

d) Trusted Execution fails to protect files when the modifications
are made via hard links. Affects AIX 6.1 only.
Track with the following APAR number: IZ13418

e) Some WPAR specific system calls may cause undefined behavior,
possibly resulting in a denial of service. Affects AIX 6.1 only.
Track with the following APAR numbers: IZ13392, IZ13346

f) A user with enough privileges to run ProbeVue can read from any
kernel memory address, resulting in information leakage. Affects
AIX 6.1 only.
Track with the following APAR number: IZ09545

The following files are vulnerable:

/usr/lib/boot/unix_64
/usr/lib/boot/unix_mp
/usr/lib/boot/unix_up
/usr/lib/drivers/hd_pin
/usr/sbin/lreducelv

The fixes below include the fixes for all of the above APARs.

II. PLATFORM VULNERABILITY ASSESSMENT

To determine if your system is vulnerable, execute the following
command:

lslpp -L bos.mp64 bos.mp bos.up bos.rte.lvm

The following fileset levels are vulnerable:

AIX Fileset Lower Level Upper Level
————————————————
bos.mp64 5.2.0.85 5.2.0.89
bos.mp64 5.2.0.95 5.2.0.102
bos.mp64 5.2.0.105 5.2.0.110
bos.mp64 5.3.0.50 5.3.0.57
bos.mp64 5.3.0.60 5.3.0.66
bos.mp64 5.3.7.0 5.3.7.2
bos.mp64 6.1.0.0 6.1.0.3

bos.mp 5.2.0.85 5.2.0.89
bos.mp 5.2.0.95 5.2.0.102
bos.mp 5.2.0.105 5.2.0.110
bos.mp 5.3.0.50 5.3.0.57
bos.mp 5.3.0.60 5.3.0.66
bos.mp 5.3.7.0 5.3.7.2

bos.rte.lvm 5.2.0.85 5.2.0.88
bos.rte.lvm 5.2.0.95 5.2.0.99
bos.rte.lvm 5.2.0.105 5.2.0.106
bos.rte.lvm 5.3.0.50 5.3.0.55
bos.rte.lvm 5.3.0.60 5.3.0.62
bos.rte.lvm 5.3.7.0 5.3.7.0

| bos.rte.tty 6.1.0.0 6.1.0.2

bos.up 5.2.0.85 5.2.0.89
bos.up 5.2.0.95 5.2.0.102
bos.up 5.2.0.105 5.2.0.110

III. SOLUTIONS

A. APARS

IBM has assigned the following APARs to this problem:

AIX Level APAR number Availability
—————————————————
5.2.0 IZ16992 Now
5.3.0 IZ17111 3/17/2008
5.3.7 IZ11820 3/17/2008
6.1.0 IZ12794 Now

Subscribe to the APARs here:

http://www.ibm.com/support/docview.wss?uid=isg1IZ16992
http://www.ibm.com/support/docview.wss?uid=isg1IZ17111
http://www.ibm.com/support/docview.wss?uid=isg1IZ11820
http://www.ibm.com/support/docview.wss?uid=isg1IZ12794

By subscribing, you will receive periodic email alerting you
to the status of the APAR, and a link to download the fix once
it becomes available.

B. FIXES

Fixes are available. The fixes can be downloaded via ftp
from:

ftp://aix.software.ibm.com/aix/efixes/security/kernel_fix.tar

The link above is to a tar file containing this signed
advisory, fix packages, and PGP signatures for each package.
The fixes below include prerequisite checking. This will
enforce the correct mapping between the fixes and AIX
Technology Levels.

AIX Level Fix (*.U) and Interim Fix (*.Z)
——————————————————————-
5.2.0 TL8 IZ16992_8a.080306.epkg.Z
IZ16992_8b.080306.epkg.Z
IZ16992_8c.080306.epkg.Z
IZ16992_8d.080306.epkg.Z
5.2.0 TL9 IZ16992_9a.080307.epkg.Z
IZ16992_9b.080306.epkg.Z
IZ16992_9c.080306.epkg.Z
IZ16992_9d.080306.epkg.Z
5.2.0 TL10 bos.mp.5.2.0.111.U
bos.mp64.5.2.0.111.U
bos.up.5.2.0.111.U
bos.rte.lvm.5.2.0.107.U
5.3.0 TL5 IZ17111_5a.080306.epkg.Z
IZ17111_5b.080306.epkg.Z
IZ17111_5c.080306.epkg.Z
IZ17111_5d.080306.epkg.Z
5.3.0 TL6 IZ17111_6a.080306.epkg.Z
IZ17111_6b.080306.epkg.Z
bos.rte.lvm.5.3.0.64.U
5.3.7 IZ11820_7a.080306.epkg.Z
IZ11820_7b.080306.epkg.Z
bos.rte.lvm.5.3.7.1.U
6.1.0 bos.mp64.6.1.0.4.U
| bos.rte.tty.6.1.0.3.U

To extract the fixes from the tar file:

tar xvf kernel_fix.tar
cd kernel_fix

Verify you have retrieved the fixes intact:

The checksums below were generated using the “sum”, “cksum”,
“csum -h MD5″ (md5sum), and “csum -h SHA1″ (sha1sum) commands
and are as follows:

sum filename
————————————
41878 5620 bos.mp.5.2.0.111.U
12951 5975 bos.mp64.5.2.0.111.U
51678 27683 bos.mp64.6.1.0.4.U
48971 1989 bos.rte.lvm.5.2.0.107.U
05910 2606 bos.rte.lvm.5.3.0.64.U
65343 2788 bos.rte.lvm.5.3.7.1.U
| 13539 400 bos.rte.tty.6.1.0.3.U
22827 5021 bos.up.5.2.0.111.U
35484 5087 IZ11820_7a.080306.epkg.Z
45602 4825 IZ11820_7b.080306.epkg.Z
16407 113 IZ16992_8a.080306.epkg.Z
11714 3708 IZ16992_8b.080306.epkg.Z
50041 3588 IZ16992_8c.080306.epkg.Z
46067 3349 IZ16992_8d.080306.epkg.Z
49122 113 IZ16992_9a.080307.epkg.Z
18653 3743 IZ16992_9b.080306.epkg.Z
62615 3623 IZ16992_9c.080306.epkg.Z
39339 3401 IZ16992_9d.080306.epkg.Z
00170 118 IZ17111_5a.080306.epkg.Z
08086 10 IZ17111_5b.080306.epkg.Z
35123 4995 IZ17111_5c.080306.epkg.Z
19037 4746 IZ17111_5d.080306.epkg.Z
14321 5050 IZ17111_6a.080306.epkg.Z
44698 4804 IZ17111_6b.080306.epkg.Z

cksum filename
——————————————-
1769871756 5754880 bos.mp.5.2.0.111.U
854968964 6118400 bos.mp64.5.2.0.111.U
1292352585 28347392 bos.mp64.6.1.0.4.U
3765659627 2036736 bos.rte.lvm.5.2.0.107.U
4292727698 2668544 bos.rte.lvm.5.3.0.64.U
656759935 2854912 bos.rte.lvm.5.3.7.1.U
| 1240743667 409600 bos.rte.tty.6.1.0.3.U
760439356 5141504 bos.up.5.2.0.111.U
2382658090 5208781 IZ11820_7a.080306.epkg.Z
3885633244 4940563 IZ11820_7b.080306.epkg.Z
2070295023 115495 IZ16992_8a.080306.epkg.Z
735615564 3796809 IZ16992_8b.080306.epkg.Z
611408700 3673977 IZ16992_8c.080306.epkg.Z
2166905248 3428899 IZ16992_8d.080306.epkg.Z
2170429470 115691 IZ16992_9a.080307.epkg.Z
1014656148 3832647 IZ16992_9b.080306.epkg.Z
3324704410 3709339 IZ16992_9c.080306.epkg.Z
1795641163 3482555 IZ16992_9d.080306.epkg.Z
3400540784 120191 IZ17111_5a.080306.epkg.Z
2984586224 9775 IZ17111_5b.080306.epkg.Z
3764592368 5114773 IZ17111_5c.080306.epkg.Z
2456126235 4859115 IZ17111_5d.080306.epkg.Z
222011986 5170787 IZ17111_6a.080306.epkg.Z
2186942398 4919125 IZ17111_6b.080306.epkg.Z

csum -h MD5 (md5sum) filename
———————————————————-
5186489f79b0afc131d411225a346999 bos.mp.5.2.0.111.U
5352a3bd27bae5dca4e4e37ab99fbaae bos.mp64.5.2.0.111.U
71697c6d95aec28488744015419dc399 bos.mp64.6.1.0.4.U
0c73aa8f0211c400455feaa6fb8a95c4 bos.rte.lvm.5.2.0.107.U
2f8ad145066390e12e2252446a183944 bos.rte.lvm.5.3.0.64.U
5924783e27116fc537e8f61b2275dddb bos.rte.lvm.5.3.7.1.U
| b98d3aa7d59ebd925f1cfaa9b35835dc bos.rte.tty.6.1.0.3.U
584b6e68e357061347ebba1cb02d1e44 bos.up.5.2.0.111.U
3bdf0c6b42d51f464565d4b979065393 IZ11820_7a.080306.epkg.Z
26fdf12c819265bb0cdce0706973b9bd IZ11820_7b.080306.epkg.Z
dd7dbdd27a20055252321c56a6a6350b IZ16992_8a.080306.epkg.Z
3c62749f4652ae0106d647244e21cfc1 IZ16992_8b.080306.epkg.Z
a08adda9df1864ef6aba017e3c194797 IZ16992_8c.080306.epkg.Z
f7ae9572cb6091232b916ec695bac6ac IZ16992_8d.080306.epkg.Z
27fd38800e29ad4b7ddc97bda9fedcc2 IZ16992_9a.080307.epkg.Z
1944d6c2e00de4c755e5f0c08546db74 IZ16992_9b.080306.epkg.Z
80ef4f2238bd6ee647ca89563f6d74da IZ16992_9c.080306.epkg.Z
7e28e491d2d2ba3e300603d10f511b8e IZ16992_9d.080306.epkg.Z
a5117f2b30ecf9b6a62c30cb4b5a9e7f IZ17111_5a.080306.epkg.Z
0dc97a5bcb07582db1c51ef5c714f245 IZ17111_5b.080306.epkg.Z
f66821b93102a8521b7f4294549f1aa7 IZ17111_5c.080306.epkg.Z
83a0b7b1002a28a8896be6209c9bda78 IZ17111_5d.080306.epkg.Z
0209225b08a8ea140edcc49779856798 IZ17111_6a.080306.epkg.Z
399a7cacd446a17d99dc07b2556a5017 IZ17111_6b.080306.epkg.Z

csum -h SHA1 (sha1sum) filename
——————————————————————
06fef79ed1644e0781b729abc7ecb5f81f843e0c bos.mp.5.2.0.111.U
561fc6f66a74e44c02eaecf2d55930dc29027126 bos.mp64.5.2.0.111.U
13904b26d77f4c38cc48dc4c44bfa45d39eaa2a0 bos.mp64.6.1.0.4.U
4589a5bca998f437aac5c3bc2c222eaa51490dab bos.rte.lvm.5.2.0.107.U
1b6544f470ddb19fa84ca03bbdc6ff55216f8df7 bos.rte.lvm.5.3.0.64.U
99bb3c53d7fca9cd0f9ae96e31c4d48ca4fb8bbe bos.rte.lvm.5.3.7.1.U
| 465e264238eb1a4d218a1e85d8397d059d68d237 bos.rte.tty.6.1.0.3.U
ed3724acab75a4e751c99b2f9a034196bef2dd27 bos.up.5.2.0.111.U
f4dc336263da0fc500f0d7ab3de0e96e21baadf7 IZ11820_7a.080306.epkg.Z
a893913e8ce82acc3490dd007aaa04c09c8ec5a0 IZ11820_7b.080306.epkg.Z
1c766f2af50743f87673cef6a4e33ce8487c7e5c IZ16992_8a.080306.epkg.Z
85515b38a0ef970ebaea64a211e2eeb19e23d9d9 IZ16992_8b.080306.epkg.Z
0d152cd131b0259fa1a7295ba33de25f2fe70bd0 IZ16992_8c.080306.epkg.Z
99fc78dfc6cfbb522853b35173c6328e455be2d1 IZ16992_8d.080306.epkg.Z
09f81efded8e5c6c96975e60e04b728c53656161 IZ16992_9a.080307.epkg.Z
b22d6ba6e1ab6912ae3520a96ba4fa9188352671 IZ16992_9b.080306.epkg.Z
f0d2a2466027ee312eedd02745c7b7a4f38a30fa IZ16992_9c.080306.epkg.Z
3aeb8ca3d0e55990f7b9d7f345a0729b641696b6 IZ16992_9d.080306.epkg.Z
5db5eea7dcdf6d9eef6766d006d824cc5c7b6620 IZ17111_5a.080306.epkg.Z
4cc96eff6aeaa48c5417a287c1ce84a3fb2a3a2d IZ17111_5b.080306.epkg.Z
b3a966360781db061dcfb268d8370e5b8b39d4e4 IZ17111_5c.080306.epkg.Z
7e37864a3c19ef3a1c559d7ca03f9860734cc189 IZ17111_5d.080306.epkg.Z
33ba9211e4206cf3c83945d823aa376c31863fe1 IZ17111_6a.080306.epkg.Z
8acf7122a26620a6550b628474c07cba1bc07c0c IZ17111_6b.080306.epkg.Z

To verify the sums, use the text of this advisory as input to
csum, md5sum, or sha1sum. For example:

csum -h SHA1 -i Advisory.asc
md5sum -c Advisory.asc
sha1sum -c Advisory.asc

These sums should match exactly. The PGP signatures in the tar
file and on this advisory can also be used to verify the
integrity of the fixes. If the sums or signatures cannot be
confirmed, contact IBM AIX Security at
security-alert@austin.ibm.com and describe the discrepancy.

C. FIX AND INTERIM FIX INSTALLATION

IMPORTANT: If possible, it is recommended that a mksysb backup
of the system be created. Verify it is both bootable and
readable before proceeding.

To preview a fix installation:

installp -a -d fix_name -p all # where fix_name is the name of the
# fix package being previewed.
To install a fix package:

installp -a -d fix_name -X all # where fix_name is the name of the
# fix package being installed.

Interim fixes have had limited functional and regression
testing but not the full regression testing that takes place
for Service Packs; thus, IBM does not warrant the fully
correct functionality of an interim fix.

Interim fix management documentation can be found at:

http://www14.software.ibm.com/webapp/set2/sas/f/aix.efixmgmt/home.html

To preview an interim fix installation:

emgr -e ipkg_name -p # where ipkg_name is the name of the
# interim fix package being previewed.

To install an interim fix package:

emgr -e ipkg_name -X # where ipkg_name is the name of the
# interim fix package being installed.

IV. WORKAROUNDS

There are no workarounds.

V. OBTAINING FIXES

AIX security fixes can be downloaded from:

ftp://aix.software.ibm.com/aix/efixes/security

AIX fixes can be downloaded from:

http://www.ibm.com/eserver/support/fixes/fixcentral/main/pseries/aix

NOTE: Affected customers are urged to upgrade to the latest
applicable Technology Level and Service Pack.

VI. CONTACT INFORMATION

If you would like to receive AIX Security Advisories via email,
please visit:

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd

Comments regarding the content of this announcement can be
directed to:

security-alert@austin.ibm.com

To request the PGP public key that can be used to communicate
securely with the AIX Security Team you can either:

A. Send an email with “get key” in the subject line to:

security-alert@austin.ibm.com

B. Download the key from a PGP Public Key Server. The key ID is:

0xA6A36CCC

Please contact your local IBM AIX support center for any
assistance.

eServer is a trademark of International Business Machines
Corporation. IBM, AIX and pSeries are registered trademarks of
International Business Machines Corporation. All other trademarks
are property of their respective holders.

VII. ACKNOWLEDGMENTS

IBM discovered and fixed this vulnerability as part of its
commitment to secure the AIX operating system.

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.7 (AIX)

iD8DBQFH6nqR8lficKajbMwRAtKHAKCVKMqJ6tXDYYlfG30SMW90mpEEyACdGeby
h02MAbhmroArA28cjN07HhQ=
=19YZ
—–END PGP SIGNATURE—–

http://www-912.ibm.com/eserver/support/fixes/fixcentral/pfixpacks/53