Security Bulletin: IBM i is vulnerable to a privilege escalation due to the ability to configure a physical file trigger in Db2 for IBM i. [CVE-2024-27275]

Summary

IBM i is vulnerable to a privilege escalation due to a user without privilege being able to configure a physical file trigger in Db2 for IBM i as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerability as described in the remediation/fixes section below.

Vulnerability Details

CVEID:CVE-2024-27275
**DESCRIPTION:**IBM i contains a local privilege escalation vulnerability caused by an insufficient authority requirement. A local user without administrator privilege can configure a physical file trigger to execute with the privileges of a user socially engineered to access the target file. The correction is to required administrator privilege to configure trigger support.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/285203 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM i	7.5
IBM i	7.4
IBM i	7.3
IBM i	7.2

Remediation/Fixes

The issue can be addressed by applying PTFs to IBM i. IBM i releases 7.5, 7.4, 7.3, and 7.2 will be fixed.

The IBM i 5770-SS1 PTF numbers and Group PTFs listed below resolve the vulnerability.

IBM i Release| 5770-SS1
PTF Numbers| PTF Download Link
—|—|—
7.5| SF99950 750 Db2 for IBM i Level 7| <https://www.ibm.com/support/pages/uid/nas4SF99950&gt;
7.4| SF99704 740 Db2 for IBM i Level 28| <https://www.ibm.com/support/pages/uid/nas4SF99704&gt;
7.3|

SJ00297

SJ00314

SJ00326

SJ00343

SJ00347

SJ00352

SJ00353

SJ00361

SJ00389

SJ00450

SJ00455

SJ00580

SJ00743

SJ00744

SJ00749

SJ00752

SJ00764

SJ00765

SJ00768

SJ00769

|

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00297&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00314&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00326&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00343&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00347&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00352&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00353&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00361&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00389&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00450&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00455&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00580&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00743&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00744&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00749&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00752&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00764&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00765&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00768&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00769&gt;

7.2|

SJ00298

SJ00315

SJ00325

SJ00346

SJ00348

SJ00354

SJ00355

SJ00360

SJ00390

SJ00449

SJ00456

SJ00581

SJ00747

SJ00748

SJ00750

SJ00753

SJ00763

SJ00766

SJ00767

SJ00770

|

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00298&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00315&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00325&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00346&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00348&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00354&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00355&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00360&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00390&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00449&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00456&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00581&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00747&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00748&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00750&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00753&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00763&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00766&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00767&gt;

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00770&gt;

https://www.ibm.com/support/fixcentral

_Important note: _IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products.

Workarounds and Mitigations

None.