Re: IBM i is vulnerable to a privilege escalation ... trigger ... [CVE-2024-27275]

[Bálint Varga-Perke <vpbalint@xxxxxxxxxxxxxxx>]

Hi there,

I just came across this older posting, and the referenced CVE looks 
awfully similar to the technique we disclosed more than a year before 
the CVE:

  https://blog.silentsignal.eu/2023/03/30/booby-trapping-ibm-i/

Bálint Varga-Perke

On 2024-06-24 21:13, Rob Berendt wrote:
> It seems a little vague but I'm trying to figure out what the issue is, and
> how they fixed it.
> https://www.ibm.com/support/pages/node/7157637
>
> Does anyone have any information they'd wish to share?
> Did IBM add another entry in WRKFCNUSG that went full on Microsoft on us
> and asks us "are you sure?" that we'd like the ability for QSECOFR to run
> ADDPFTRG?
>
> Was the concern that someone with minimal security could add a trigger that
> would detect when someone with *ALLOBJ and *SECADM updated a file and have
> it execute a command like CHGUSRPRF PEON SPCAUT(*ALLOBJ *SECADM *AUDIT
> *IOSYSCFG *JOBCTL *SAVSYS *SERVICE *SPLCTL)
> Probably a good reason not to run regular programs with a user with
> elevated privileges.
>
> According to the link. you need to apply the latest DB2 group ptf to patch
> it.  That's a wee bit more disruptive than many other PTFs.