PT-2023-4594 · Ibm · Vios+1

Published 2023-08-23 · Updated 2024-09-20 · CVE-2023-40371

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 through 7.3 VIOS version 3.1

Description The issue is related to improper access controls in the OpenSSH implementation, which could allow a non-privileged local user to access files outside of those allowed. This could potentially lead to unauthorized access to confidential data. There is also a mention of a flaw in the forwarded ssh-agent that could allow a remote attacker to execute arbitrary code on the system by sending specially crafted requests.

Recommendations For IBM AIX versions 7.2 through 7.3, apply the ifix 38408 from openssh fix15, and then restart the sshd service to ensure the fix is applied. For VIOS version 3.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Information Disclosure

Weakness Enumeration

CWE-327

CWE-200

Related Identifiers

BDU:2023-05001

CVE-2023-40371

Affected Products

Ibm Aix

Vios

References · 8

• https://ibm.com/support/pages/node/7028420 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/263476 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40371 · Security Note
• https://bdu.fstec.ru/vul/2023-05001 · Security Note
• https://t.me/cvenotify/57172 · Telegram Post
• https://t.me/cvenotify/95513 · Telegram Post
• https://twitter.com/CPetersen_CS/status/1695179609699143989 · Twitter Post