CVE-2023-42006
📋 TL;DR
This vulnerability in IBM Administration Runtime Expert for i allows local users to bypass proper authority checks and access sensitive information they shouldn't have permission to view. It affects IBM i (AS/400) systems running Administration Runtime Expert versions 7.2 through 7.5. The vulnerability requires local access to the system.
💻 Affected Systems
- IBM Administration Runtime Expert for i
📦 What is this software?
I by Ibm
I by Ibm
I by Ibm
I by Ibm
⚠️ Risk & Real-World Impact
Worst Case
A malicious local user could access sensitive system information, configuration data, or potentially escalate privileges to gain unauthorized administrative access to the IBM i system.
Likely Case
Local users with limited permissions could access sensitive information about system configuration, user accounts, or other administrative data they shouldn't be able to view.
If Mitigated
With proper access controls and least privilege principles, the impact is limited to authorized users who already have some level of system access.
🎯 Exploit Status
Exploitation requires local access to the IBM i system. The vulnerability involves improper authority checks, suggesting relatively straightforward exploitation once local access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply IBM i PTF Group SF99738 Level 26 or later
Vendor Advisory: https://www.ibm.com/support/pages/node/7085891
Restart Required: Yes
Instructions:
1. Check current PTF level on IBM i system
2. Apply IBM i PTF Group SF99738 Level 26 or later
3. Restart the system as required
4. Verify the PTF was successfully applied
🔧 Temporary Workarounds
Restrict local access
ibmiLimit local access to IBM i systems to only authorized administrative personnel
GRTOBJAUT OBJ(QSYS/*ALL) OBJTYPE(*LIB) USER(*PUBLIC) AUT(*EXCLUDE)
CHGUSRAUD USRPRF(user_profile) SPCAUT(*NONE)
Implement least privilege
ibmiEnsure users only have minimum necessary permissions on the system
WRKUSRPRF user_profile
Edit user profile to remove unnecessary special authorities
🧯 If You Can't Patch
- Implement strict access controls to limit local system access to trusted administrators only
- Monitor system logs for unauthorized access attempts to Administration Runtime Expert functions
🔍 How to Verify
Check if Vulnerable:
Check if Administration Runtime Expert version 7.2-7.5 is installed and if PTF Group SF99738 Level 26 is not appliedCheck Version:
DSPPTF LICPGM(5770SS1) or GO LICPGM to check installed PTFsVerify Fix Applied:
Verify PTF Group SF99738 Level 26 or later is installed using DSPPTF command📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to Administration Runtime Expert functions
- Unusual user activity in QSYSOPR or other system logs
- Failed authority checks in security audit journal
Network Indicators:
- N/A - Local vulnerability only
SIEM Query:
Search for events where user with limited privileges accesses Administration Runtime Expert functions or sensitive system objects