How to remediate – AIX bellmail Advisory : suid_advisory.asc (IV97356) (IV99497) …

1. Introduction

The AIX bellmail Advisory : suid_advisory.asc (IV97356) (IV99497) vulnerability affects versions of bellmail installed on AIX systems. This is a privilege escalation issue where a local attacker can gain root access. This impacts the confidentiality, integrity and availability of affected systems.

2. Technical Explanation

The vulnerable version of bellmail has a setuid bit enabled which allows a local user to execute code with elevated privileges. A malicious actor could exploit this by crafting an input that triggers execution of arbitrary commands as root. This is tracked as CVE-2017-1692. For example, an attacker could modify the bellmail program to launch a shell with root permissions.

• Root cause: The setuid bit on the bellmail executable allows privilege escalation.
• Exploit mechanism: An attacker can exploit this by modifying the bellmail program and executing it.
• Scope: AIX systems running vulnerable versions of bellmail.

3. Detection and Assessment

You can confirm if a system is vulnerable by checking the installed version of bellmail and verifying the setuid bit status.

• Quick checks: Use the following command to check the file permissions: ls -l /usr/bin/bellmail. If the output shows ‘s’ in the permission string (e.g., ‘-rwsr-xr-x’), it indicates a setuid bit is enabled.
• Scanning: Nessus plugin ID 1048692 can detect this vulnerability, but results should be verified manually.
• Logs and evidence: Check system logs for unusual activity related to the bellmail executable.

ls -l /usr/bin/bellmail

4. Solution / Remediation Steps

Apply the fix available from IBM AIX website to resolve this vulnerability.

4.1 Preparation

4.2 Implementation

1. Step 1: Download the appropriate fix package from https://aix.software.ibm.com/aix/efixes/security/suid_advisory.asc.
2. Step 2: Install the fix package using the smitty apply command or equivalent method for your AIX version.

4.3 Config or Code Example

There is no config change needed, this requires patching the bellmail executable.

Before

-rwsr-xr-x   1 root system  ... /usr/bin/bellmail

After

-rwxr-xr-x   1 root system ... /usr/bin/bellmail

4.4 Security Practices Relevant to This Vulnerability

Practices such as least privilege and regular patch management are relevant to this vulnerability. Least privilege can limit the impact of exploitation, while patching ensures systems are protected against known vulnerabilities.

• Practice 1: Apply the principle of least privilege to all system accounts and processes.
• Practice 2: Implement a robust patch management process to apply security updates promptly.

4.5 Automation (Optional)

Automation is not recommended for this specific fix due to the potential risks associated with patching critical system components without proper testing.

5. Verification / Validation

• Post-fix check: Run ls -l /usr/bin/bellmail. The output should *not* show ‘s’ in the permission string (e.g., ‘-rwxr-xr-x’).
• Re-test: Re-run the initial detection command to confirm that the vulnerability is no longer present.
• Smoke test: Verify basic bellmail functionality, such as sending and receiving emails.

ls -l /usr/bin/bellmail

6. Preventive Measures and Monitoring

Regular security baselining and asset management can help prevent similar vulnerabilities in the future. For example, update your security baseline to include a check for setuid bits on critical system executables.

• Baselines: Update your AIX security baseline to include checks for unnecessary setuid/setgid permissions.
• Pipelines: Integrate vulnerability scanning into your CI/CD pipeline to identify and address vulnerabilities early in the development lifecycle.
• Asset and patch process: Implement a regular patch review cycle (e.g., monthly) to ensure timely application of security updates.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Patching may require system reboot which will result in downtime.

8. References and Resources

Official advisories and documentation are the best sources of information for this vulnerability.

• Vendor advisory or bulletin: https://aix.software.ibm.com/aix/efixes/security/suid_advisory.asc
• NVD or CVE entry: CVE-2017-1692