Zoltan Panczel

Name of the Vulnerable Software and Affected Versions: IBM i versions 7.2 through 7.5 Description: The issue allows a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator privilege. Recommendations: For IBM i versions 7.2 through 7.5, consider restricting access to the Facsimile Support for i until a patch is available to prevent exploitation of the unqualified library call. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM i versions 7.2 through 7.6 **Description** The issue allows a user to gain elevated privileges due to an unqualified library call in IBM Advanced Job Scheduler for i. A malicious actor could cause user-controlled code to run with administrator privilege. **Recommendations** For IBM i versions 7.2 through 7.6, update to a version that includes the fix for the elevated privilege issue.

**Name of the Vulnerable Software and Affected Versions** IBM Backup, Recovery and Media Services for i versions 7.4 through 7.5 **Description** The issue allows a user with the capability to compile or restore a program to gain elevated privileges due to a library unqualified call made by a BRMS program. A malicious actor could cause user-controlled code to run with component access to the host operating system. **Recommendations** For versions 7.4 and 7.5, consider restricting the capability to compile or restore programs to trusted users until a patch is available. As a temporary workaround, review and limit access to the BRMS program to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** IBM System Management for i versions 7.2 through 7.4 **Description** The issue allows a local user to gain elevated privileges due to an unqualified library program call. A malicious actor could cause user-controlled code to run with administrator privilege. **Recommendations** For versions 7.2 through 7.4, consider restricting access to the library program call until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM Db2 for i versions 7.2 through 7.5 **Description** The issue allows a local authenticated attacker to perform user enumeration without having authority to the related *USRPRF objects. This can be used by a malicious actor to gather information about users that can be targeted in further attacks. **Recommendations** For IBM Db2 for i versions 7.2 through 7.5, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM i versions 7.2 through 7.5 Service Tools Server (SST) **Description** The issue is related to the disclosure of information through inconsistency, allowing a remote attacker to gather information about SST users that can be targeted in further attacks. This can be used by a malicious actor to exploit the vulnerability and potentially launch further attacks. **Recommendations** For IBM i versions 7.2 through 7.5, consider restricting access to the Service Tools Server (SST) to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the information disclosed by SST to prevent user enumeration. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM i versions 7.2 through 7.4 **Description** The issue is related to flaws in the deserialization mechanism of the IBM i operating system. Exploitation of this issue could allow a remote attacker to execute arbitrary code, leading to a denial of service of network ports on the system. This is caused by the deserialization of untrusted data. **Recommendations** For IBM i versions 7.2 through 7.4, upgrade the affected component as soon as possible to prevent remote code execution and network disruption due to unsafe data deserialization. As a temporary workaround, consider restricting access to network ports to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** IBM i versions 7.2 through 7.5 **Description** The issue is related to insecure privilege management in the Management Central component of the IBM i operating system. A malicious actor with command line access to the operating system can exploit this to elevate privileges and gain root access to the operating system. **Recommendations** For IBM i versions 7.2 through 7.5, update to a version that contains a fix for this issue, as no specific workaround or mitigation measures are provided in the available information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM i versions 7.2 through 7.5 **Description** The issue is related to insecure privilege management in the Management Central component of the IBM i operating system. A malicious actor with command line access can exploit this to elevate privileges and gain access to operating system components. **Recommendations** For IBM i versions 7.2 through 7.5, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Backup, Recovery, and Media Services (BRMS) for IBM i versions 7.2 through 7.4 **Description** A local privilege escalation issue exists, allowing a malicious actor with command line access to the host operating system to elevate privileges and gain component access to the host operating system. **Recommendations** For versions 7.2 through 7.4, update to a version that includes the fix for this issue to prevent local privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM Directory Server for IBM i (affected versions not specified) **Description** The issue is a local privilege escalation problem. A malicious actor with command line access to the host operating system can elevate privileges to gain component access to the host operating system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Integrated application server for IBM i versions 7.2 through 7.5 **Description** The issue is a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain root access to the host operating system. **Recommendations** For versions 7.2 through 7.5, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM i versions 7.2 through 7.5 **Description** The issue concerns a local privilege escalation vulnerability in the Facsimile Support for i product. A malicious actor with command line access to the host operating system can exploit this vulnerability to elevate privileges and gain root access to the host operating system. **Recommendations** For IBM i versions 7.2 through 7.5, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM Performance Tools for i versions 7.2 through 7.5 **Description** A local privilege escalation issue allows a malicious actor with command line access to the host operating system to elevate privileges and gain all object access to the host operating system. **Recommendations** For versions 7.2 through 7.5, consider restricting command line access to the host operating system to minimize the risk of exploitation. As a temporary workaround, review and limit special authorities assigned to users and programs to prevent unauthorized privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM i versions 7.2 through 7.5 **Description** The issue allows a remote attacker to execute CL commands as QUSER, caused by an exploitation of DDM architecture. Approximately 856 devices are potentially affected. **Recommendations** For IBM i versions 7.2 through 7.5, consider disabling the DDM service until a patch is available to prevent remote attackers from executing CL commands as QUSER. At the moment, there is no information about a newer version that contains a fix for this vulnerability.