IBM i Access Family up to 1.1.4.3/1.1.9.0 untrusted search path

Summaryinfo

A vulnerability identified as critical has been detected in IBM i Access Family up to 1.1.4.3/1.1.9.0. This issue affects some unknown processing. The manipulation leads to untrusted search path. This vulnerability is uniquely identified as CVE-2022-40746. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in IBM i Access Family up to 1.1.4.3/1.1.9.0 and classified as critical. This issue affects some unknown functionality. The manipulation with an unknown input leads to a untrusted search path vulnerability. Using CWE to declare the problem leads to CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability. By placing a specially crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 236581.

The weakness was disclosed 11/21/2022. The advisory is shared at ibm.com. The identification of this vulnerability is CVE-2022-40746 since 09/16/2022. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/21/2022). It is expected to see the exploit prices for this product increasing in the near future.MITRE ATT&CK project uses the attack technique T1574 for this issue.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at X-Force (236581). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• IBM

Name

• i Access Family

Version

• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3
• 1.1.4
• 1.1.4.0
• 1.1.4.1
• 1.1.4.2
• 1.1.4.3
• 1.1.5
• 1.1.6
• 1.1.7
• 1.1.8
• 1.1.9.0

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion