IBM RACF Profile Updating Privilege Elevation Vulnerability

Bugtraq ID:	7959
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 18 2003 12:00AM
Updated:	Jun 18 2003 12:00AM
Credit:	This issue was announced in an IBM advisory.
Vulnerable:	IBM z/OS IBM RACF/MVS 1.9.2 IBM RACF/MVS 1.8.1 IBM RACF/MVS 1.8 IBM RACF/MVS 1.7 IBM RACF 2.2 IBM RACF 2.1 IBM RACF 1.9 IBM RACF 1.7 IBM RACF 1.6 IBM RACF 1.5 IBM RACF 1.4 IBM RACF 1.3 IBM RACF 1.2 IBM RACF 1.1 IBM OS/390 V2R9 IBM OS/390 V2R6
Not Vulnerable:

IBM RACF Profile Updating Privilege Elevation Vulnerability

A vulnerability has been discovered in the IBM Resource Access Control Facility (RACF). The problem occurs when updating mapping profiles and may result in a users privileges being modified when in fact the invoked command failed. This could ultimately result in privilege elevation if a privileged application were to carryout UserID to username translation to verify authorization.

IBM RACF Profile Updating Privilege Elevation Vulnerability

Solution:
IBM has released APAR OA02696 to address this issue. Users/administrators can obtain further information by contacting the vendor.


IBM RACF 1.1

• IBM OA02696
  

IBM RACF 1.2

• IBM OA02696
  

IBM RACF 1.3

• IBM OA02696
  

IBM RACF 1.4

• IBM OA02696
  

IBM RACF 1.5

• IBM OA02696
  

IBM RACF 1.6

• IBM OA02696
  

IBM RACF/MVS 1.7

• IBM OA02696
  

IBM RACF 1.7

• IBM OA02696
  

IBM RACF/MVS 1.8

• IBM OA02696
  

IBM RACF/MVS 1.8.1

• IBM OA02696
  

IBM RACF 1.9

• IBM OA02696
  

IBM RACF/MVS 1.9.2

• IBM OA02696
  

IBM RACF 2.1

• IBM OA02696
  

IBM RACF 2.2

• IBM OA02696
  

IBM RACF Profile Updating Privilege Elevation Vulnerability

References:

• MSS-OAR-E01-2003.0795.1 (IBM)
  
• RACF Home Page (IBM)