IBM i Access Client Solutions code execution

Vulnerability

IBM i Access Client Solutions (ACS) versions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 are affected by CVE-2023-45185, a remote code execution vulnerability. The flaw lies in the software's failure to authenticate the origin of a serialized object, allowing an attacker to execute arbitrary code. This occurs due to improper authority checks enabling operations under the user's privileges.

Exploitation

An attacker needs network access and requires authentication to the system, as the CVSS vector indicates a privilege required (PR:L). The attacker can send a specially crafted serialized object to the target system. No user interaction is needed, and the attack can be launched remotely.

Impact

Successful exploitation allows the attacker to execute remote code on the affected system under the user's authority. This can lead to partial compromise of confidentiality, integrity, and availability (CVSS: C:L/I:L/A:L) with a scope change to other components (S:C).

Mitigation

IBM has released a fix for this vulnerability. Users should update IBM i Access Client Solutions to a patched version as detailed in the IBM security bulletin [1]. Apply the recommended updates from the Fix Central or contact IBM support for guidance. No workarounds are mentioned; patching is the sole mitigation.