Denial of Service in IBM i Due to Zero-Length TCP Options

Executive Summary

IBM i 7.6, 7.5, 7.4, and 7.3 are vulnerable to a denial of service (DoS) attack due to improper handling of zero-length TCP options. A remote attacker could exploit this flaw to cause system disruption by triggering an infinite loop, classified under CWE-835.

Useful 0 Not Useful 0

Detection Guidance

Detection involves monitoring for unusual network traffic patterns or system behavior that may indicate exploitation attempts. Check for repeated TCP connections with zero-length options or signs of infinite loops in network logs. Use network monitoring tools like tcpdump or Wireshark to capture and analyze TCP traffic for malformed packets targeting IBM i systems.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a remote attacker to cause a denial of service, leading to system unavailability. Affected versions include IBM i 7.3, 7.4, 7.5, and 7.6 running the 5770-999 license program. The impact is high severity with a CVSS base score of 7.5.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial of service attacks that disrupt system availability. Downtime may lead to unauthorized access risks or failure to meet data processing or protection requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the recommended PTFs immediately: MJ10914 for IBM i 7.3, MJ10913 for 7.4, MJ10912 for 7.5, and MJ10911 for 7.6. If running unsupported versions, upgrade to a supported release. Disable unnecessary network services and restrict access to IBM i systems until patches are applied.

Useful 0 Not Useful 0