CVE-2023-28528: Critical Vulnerability in IBM AIX and VIOS - Local Non-Privileged User Arbitrary Command Execution

A recent security vulnerability has been discovered in IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 operating systems with the potential to allow a non-privileged local user to execute arbitrary commands. The vulnerability exists in the "invscout" command and has been assigned the CVE-2023-28528 identifier. IBM X-Force ID for this vulnerability is 251207.

In this article, we will cover the details of the vulnerability, provide information on how to determine if your system is affected, and offer suggestions on how to mitigate risks associated with the vulnerability.

Details

The vulnerability in question allows a non-privileged local user to exploit the "invscout" command in order to execute commands of their choosing. "invscout" is a command-line utility provided by IBM in its AIX and VIOS operating systems to gather system inventory information.

An attacker could leverage this vulnerability to perform unauthorized actions on the affected system, potentially leading to data loss, unauthorized access, or other security breaches.

Here's a simple example demonstrating the vulnerability

$ id
uid=999(nonprivileged) gid=999(nonprivileged) groups=999(nonprivileged)

$ invscout -g ';/your/command/here;#'

By manipulating the command parameters and executing the "invscout" command, a non-privileged local user can execute arbitrary commands on the affected system.

References

IBM Security Bulletin: https://www.ibm.com/support/pages/node/6728604
IBM X-Force Exchange: https://exchange.xforce.ibmcloud.com/vulnerabilities/251207
CVE Details: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28528

Detection

To determine if your system is affected by this vulnerability, check the OS version by running the following command:

$ oslevel -s

If your system's output indicates one of the vulnerable versions mentioned above, it is recommended that you take appropriate action to protect your system.

Mitigation

IBM has released updates to address this vulnerability. It is highly recommended that affected systems be updated as soon as possible to patch the vulnerability and protect against potential exploits.

Follow the IBM Security Bulletin for instructions on how to apply the necessary updates: https://www.ibm.com/support/pages/node/6728604

Conclusion

CVE-2023-28528 is a critical vulnerability in IBM AIX and VIOS operating systems that allows a non-privileged local user to execute arbitrary commands on the affected system. It is important to ensure that your systems are up-to-date with the latest security patches provided by IBM in order to protect against potential exploits.

Stay vigilant and keep your systems updated to safeguard your critical data and infrastructure.

Timeline

Published on: 04/28/2023 03:15:00 UTC
Last modified on: 05/18/2023 16:15:00 UTC