Security Bulletin: IBM i is vulnerable to a local privilege escalation due to flaws in Management Central (CVE-2023-40685, CVE-2023-40686).

Summary

IBM i is vulnerable to a local privilege escalation due to flaws in a Management Central as described in the vulnerability details section. The vulnerabilities exist even when Management Central is not being used for systems management tasks. IBM i has addressed the vulnerabilities with fixes as described in the remediation/fixes section.

Vulnerability Details

CVEID:CVE-2023-40686
**DESCRIPTION:**Management Central as part of IBM i Navigator contains a local privilege escalation vulnerability. A malicious actor with command line access to the operating system can exploit this vulnerability to elevate privileges to gain component access to the operating system.
CVSS Base score: 4.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/264114 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID:CVE-2023-40685
**DESCRIPTION:**Management Central as part of IBM i Navigator contains a local privilege escalation vulnerability. A malicious actor with command line access to the operating system can exploit this vulnerability to elevate privileges to gain root access to the operating system.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/264116 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

The issues can be fixed by applying PTFs to IBM i. IBM i releases 7.5, 7.4, 7.3, and 7.2 will be fixed.

The IBM i PTF numbers for 5770-SS1 Base and 5770-SS1 Option 3 contain the fixes for the vulnerabilities.

IBM i Release| 5770-SS1
Option 3| PTF Download Link
—|—|—
7.5| SI85339| <https://www.ibm.com/support/pages/ptf/SI85339&gt;
7.4| SI84784| <https://www.ibm.com/support/pages/ptf/SI84784&gt;
7.3| SI84783| <https://www.ibm.com/support/pages/ptf/SI84783&gt;
7.2| SI84782| <https://www.ibm.com/support/pages/ptf/SI84782&gt;

<https://www.ibm.com/support/fixcentral&gt;

Important note: IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products.

Workarounds and Mitigations

None