Security Bulletin: AIX is vulnerable to arbitrary code execution due to RPM (CVE-2023-7104)

Summary

Vulnerability in RPM could allow a remote authenticated attacker to execute arbitrary code (CVE-2023-7104). RPM is used by AIX for package management.

Vulnerability Details

CVEID:CVE-2023-7104
**DESCRIPTION:**SQLite SQLite3 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the sessionReadRecord function in ext/session/sqlite3session.c. By sending a specially crafted request, a remote authenticated attacker could overflow a buffer and execute arbitrary code on the system.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/276235 for the current score.
CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

The vulnerabilities in the following filesets are being addressed:

To find out whether the affected filesets are installed on your systems, refer to the lslpp command found in AIX user’s guide.

Example: lslpp -L | grep -i rpm.rte

Remediation/Fixes

FIXES

IBM strongly recommends addressing the vulnerability now.

A fix is available, and it can be downloaded from:

<https://www.ibm.com/resources/mrs/assets?source=aixbp&gt;

For 7.2 TL5 and VIOS 3.1:

rpm.rte.4.15.1.1013

For 7.3 TL0 and TL1:

rpm.rte.4.15.1.2011

For 7.3 TL2 and VIOS 4.1:

rpm.rte.4.18.1.2003

IMPORTANT: If possible, it is recommended that a mksysb backup of the system be created. Verify it is both bootable and readable before proceeding.

Note that all the previously reported security vulnerability fixes are also included in above mentioned fileset level.

To preview the fix installation:

installp -apYd . rpm

To install the fix package:

installp -aXYd . rpm

openssl dgst -sha256 -verify [pubkey_file] -signature [advisory_file].sig [advisory_file]

openssl dgst -sha256 -verify [pubkey_file] -signature [ifix_file].sig [ifix_file]

Published advisory OpenSSL signature file location:

<https://aix.software.ibm.com/aix/efixes/security/rpm_advisory2.asc.sig&gt;

Workarounds and Mitigations

None