PT-2022-25506 · Ibm · Ibm I Access Family

Maksymilian Kubiak · Published 2022-11-21 · Updated 2022-11-23 · CVE-2022-40746

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM i Access Family versions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0

Description The issue allows a local authenticated attacker to execute arbitrary code on the system due to a DLL search order hijacking vulnerability. An attacker could exploit this by placing a specially crafted file in a compromised folder, enabling the execution of arbitrary code on the system.

Recommendations For IBM i Access Family versions 1.1.2 through 1.1.4, update to a version outside of this range to mitigate the risk. For IBM i Access Family versions 1.1.4.3 through 1.1.9.0, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to compromised folders to minimize the risk of exploitation.

Fix

Command Injection

Uncontrolled Search Path Element

Weakness Enumeration

CWE-77

CWE-427

Related Identifiers

CVE-2022-40746

Affected Products

Ibm I Access Family

References · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/236581 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40746 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40746 · Vendor Advisory
• https://ibm.com/support/pages/node/6840359 · Vendor Advisory
• https://t.me/cibsecurity/53273 · Telegram Post