CVE-2023-38370
📋 TL;DR
IBM Security Access Manager Docker containers (versions 10.0.0.0 through 10.0.7.1) with certain configurations allow network users to install malicious packages. This could lead to unauthorized code execution or system compromise. Only specific configurations are vulnerable, not all deployments.
💻 Affected Systems
- IBM Security Access Manager Docker
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full control of the container, installs backdoors, steals credentials, and pivots to other systems.
Likely Case
Unauthorized package installation leading to data exfiltration, persistence mechanisms, or service disruption.
If Mitigated
Limited impact due to network segmentation and proper configuration hardening.
🎯 Exploit Status
Requires network access and specific vulnerable configuration. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.7.2 or later
Vendor Advisory: https://www.ibm.com/support/pages/node/7158790
Restart Required: Yes
Instructions:
1. Download IBM Security Access Manager Docker version 10.0.7.2 or later from IBM Fix Central. 2. Stop the vulnerable container. 3. Deploy the updated container image. 4. Verify the new version is running.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict network access to IBM Security Access Manager Docker containers to only necessary systems.
iptables -A INPUT -s <trusted_network> -p tcp --dport <container_port> -j ACCEPT
iptables -A INPUT -p tcp --dport <container_port> -j DROP
Configuration Hardening
allReview and modify configurations to avoid the vulnerable state mentioned in IBM advisory.
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the container.
- Monitor container logs for unauthorized package installation attempts.
🔍 How to Verify
Check if Vulnerable:
Check IBM Security Access Manager Docker version. If between 10.0.0.0 and 10.0.7.1 and using certain configurations, assume vulnerable.Check Version:
docker exec <container_name> cat /opt/ibm/isam/version.txtVerify Fix Applied:
Verify the container is running version 10.0.7.2 or later using docker inspect or version check command.📡 Detection & Monitoring
Log Indicators:
- Unexpected package installation logs in container
- Unauthorized network connections to package repositories
Network Indicators:
- Unusual outbound connections from container to external repositories
- Suspicious inbound connections to container management ports
SIEM Query:
source="docker" AND ("package install" OR "yum install" OR "apt-get install") AND NOT user="authorized_user"