## Summary
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code in the Debug Server due to improper bounds checking (CWE-787). IBM recommends addressing the issue immediately.
## Technical Details
- Vulnerability type: improper bounds checking leading to arbitrary code execution.
- Affected component: IBM i Debug Server (described in the IBM security bulletin as “multiple vulnerabilities … in Debug Server”).
- Attack prerequisites (from NVD vector): network-reachable with low attack complexity and requires authentication (PR:L, UI:N, AC:L, AV:N).
## Affected
- IBM i 7.6 (7.6 SS1)
- IBM i 7.5 (7.5 SS1)
- IBM i 7.4 (7.4 SS1)
- IBM i 7.3 (7.3 SS1)
## Impact
- Potential for arbitrary code execution on the target IBM i system.
- Likely impact profile (from CVSS): confidentiality and integrity impact are limited/partial, while integrity impact is high (I:H), with availability impact lower (A:L).
## Mitigation
1. Apply the IBM-provided PTFs for the affected releases:
- 7.6 : PTF SJ10899
- 7.5 : PTF SJ10903
- 7.4 : PTF SJ10915
- 7.3 : PTF SJ10916
2. Follow IBM’s guidance to upgrade unsupported versions to a supported fixed release.
3. Note: the bulletin lists no workarounds/mitigations (“None”).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CWE-787