IBM89B6F8544C5199AEBF8E2B8D9CE4FB12D81E64EE509E0AC036017D808B90CF43Security Bulletin: IBM i is vulnerable to a local privilege escalation due to a flaw in IBM Directory Server for i (CVE-2023-40378).
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.0004 Low
EPSS
Percentile
5.1%
Summary
IBM i is vulnerable to a local privilege escalation due to a flaw in IBM Directory Server for i as described in the vulnerability details section. IBM Directory Server for i has addressed the vulnerability with a fix as described in the remediation/fixes section.
Vulnerability Details
CVEID:CVE-2023-40378
**DESCRIPTION:**IBM Directory Server for IBM i contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain component access to the host operating system.
CVSS Base score: 4.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/263584 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM i | 7.5 |
| IBM i | 7.4 |
| IBM i | 7.3 |
| IBM i | 7.2 |
Remediation/Fixes
The issue can be fixed by applying a PTF to IBM i. IBM i releases 7.5, 7.4, 7.3, and 7.2 will be fixed.
The IBM i PTF number for 5770-SS1 contains the fix for the vulnerability.
| IBM i Release | 5770-SS1 | PTF Download Link |
|---|---|---|
| 7.5 | SI84813 | <https://www.ibm.com/support/pages/ptf/SI84813> |
| 7.4 | SI84817 | <https://www.ibm.com/support/pages/ptf/SI84817> |
| 7.3 | SI84842 | <https://www.ibm.com/support/pages/ptf/SI84842> |
| 7.2 | SI84836 | <https://www.ibm.com/support/pages/ptf/SI84836> |
<https://www.ibm.com/support/fixcentral>
Important note: IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products.
Workarounds and Mitigations
None
Affected configurations
Related
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.0004 Low
EPSS
Percentile
5.1%