Security Bulletin: IBM i Access Client Solutions is vulnerable to remote credential theft when NTLM is enabled on Windows workstations

Summary

IBM i Access Client Solutions (ACS) is vulnerable to remote credential theft when NT LAN Manager (NTLM) is enabled on Windows workstations (CVE-2024-22318). Since IBM i Access Client solutions allows Universal Naming Convention (UNC) paths in its configuration files, if a path is modified to point to a hostile server, the NTLM hash can be harvested during the NTLM authentication and used for an additional attack.

Vulnerability Details

CVEID:CVE-2024-22318
**DESCRIPTION:**IBM i Access Client Solutions (ACS) is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modifying UNC capable paths within ACS configuration files to point to a hostile server. If NTLM is enabled, the Windows operating system will try to authenticate using the current user’s session. The hostile server could capture the NTLM hash information to obtain the user’s credentials.
CVSS Base score: 5.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/279091 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

None

Workarounds and Mitigations

NT LAN Manager (NTLM) is not used directly by IBM i Access Client Solutions (ACS), nor does ACS have any specific support for it. Since ACS does not prevent the usage of Universal Naming Convention (UNC) paths, when a UNC path is encountered while using ACS, NTLM authentication could be performed by the Windows operating system. Administrators and users need to be aware that if NTLM is enabled on a Windows workstation it is vulnerable to a variety of NTLM security issues.

IBM recommends not using NT LAN Manager (NTLM). For information on restricting NTLM, see section 11.1.4 Restricting Windows NTLM in the GettingStarted document for**IBM i Access Client Solutions **with a publish date of January 24, 2024 or later.

Please note: Users of future releases of IBM i Access family of products should be directed to follow this same guidance.