IBM Developer

Tutorial

Identify, download, and install the security interim fixes

Guidance to protect your system from security vulnerabilities

By Akash Tripathi, Srikanth Thanneeru

On this page

Introduction

Maintaining your system to address required security vulnerabilities is crucial. This practice ensures that your system is protected from external threats, such as man-in-the-middle attacks and denial-of-service (DoS) attacks. It also prevents attackers or non-privileged local users from exploiting vulnerabilities to access sensitive information. This tutorial describes the process to identify, download, and install interim fixes to protect your system from security vulnerabilities.

Understanding the basics

If your IBM AIX system has internet access, you can run the emgr_check_ifixes command to scan for the available AIX security interim fixes compatible with your current AIX operating system level. This command also validates the signature of the security advisory and downloads the interim fixes in a specific path (if specified) to your AIX host.

Additionally, you can use the emgr_sec command to install interim fixes. The emgr_sec command validates the digital signature of a security interim fix before installing it, offering AIX administrators a convenient way to keep their systems up-to-date with essential security patches.

If you have to install individual security interim fixes that are archived in the tar format, you can use the emgr_sec_patch command. It extracts the .tar file, identifies the applicable interim fixes for the current operating system level, and installs the individual security interim fixes.

Interim fix installation

This section provides a detailed overview of the operational stage-wise workflow of the commands used to identify, download, and install interim fixes on any system.

Stage 1: Identifying the necessary interim fixes

The emgr_check_ifix command first locates the authorized program analyst report (APAR) of all interim fixes already installed on the system. It then verifies the Secure Sockets Layer (SSL) connection with the esupport.ibm.com server. Next, it retrieves the list of all interim fixes available on the esupport.ibm.com server for the specific AIX OS level. From this list, it extracts all entries for security interim fixes that are eligible for download.

Stage 2: Downloading the interim fixes

The emgr_check_ifix command verifies the server's certificate of the aix.software.ibm.com server, which is used to download the interim fix-related files. It processes the security interim fix list obtained in the earlier step to find the APAR, advisory file, advisory file signature location, interim fix download URL, and other useful information.

The APAR number is used to identify if the interim fix is already installed in the system. If the APAR is not available on the system, it downloads the advisory file and the advisory signature file for the particular interim fix and performs the advisory file signature validation. Successful advisory file validation indicates that the advisory file can be parsed to locate the interim fix download link and the corresponding .tar file name for the appropriate Version-Release-Modification-Fix (VRMF) that needs to be installed.

When you run the emgr_check_ifix command with the -D flag, it internally passes the interim fix download links to the emgr_download_ifix command to facilitate the download of the interim fixes. The .tar file is eventually used by the emgr_download_ifix command, which downloads everything to the default location “/tmp/${PID}” unless specified with the -P flag.

Stage 3: Installing the interim fixes

Interim fixes can be available as a single file or as an archived file in the tar format. If it is a single file, you can use the emgr_sec command to install the interim fixes. The emgr_sec command will first look for a 4096-bit long signature (4K sig) in the same location where the interim fix is present. If it finds the 4K sig, then the emgr_sec command will further use the corresponding 4K key. The emgr_sec command validates the digital signature of a security interim fix using OpenSSL before the interim fix is installed. If it does not find the 4K sig in the first place, then it is possible that the secure interim fix is signed with the 2048-bit long signature (2K sig). It proceeds with the 2K sig and a key for verification and installation.

If the security interim fixes are archived in the tar format, you must use the emgr_sec_patch command. Secure patches are just an extension of the secure interim fixes, where the .tar file can contain multiple fixes. Therefore, for every interim fix there is a mapping sig file. This sig file can be 4K or 2K.

Apart from containing the interim fix and their signature, the.tar file also contains the advisory_asc file and the corresponding signature file for it. When you need to install a secure patch, the emgr_sec_patch script first looks for the advisory_asc.4Ksig file inside the .tar file. If it finds the .4Ksig file, it means that this secure interim fix patch is signed with 4K method. In that case, you can use the key_4K_w_csum keyword to get the checksum values for the corresponding interim fixes and verify these checksum values one by one using the openssl command. If the advisory_sec.4ksig file is not available, then it will verify the advisory_asc file with advisory_asc.sig (2K) and use the grep key_w_csum command to verify the checksum value of the interim fixes.

After successfully verifying the advisory_asc file and checking if the interim fixes checksum values match, you can now move to individual interim fix signature verification and installation.

Examples of interim fix commands

This section provides examples of the commands to identify, download, and install interim fixes.

emgr_check_ifixes

To check the availability of security interim fixes for the current operating system level, enter the following command:

# emgr_check_ifixes
Gathering system information
+-----------------------------------------------------------------------------+
p0.mtm=8286-42A
p0.fw=SV860_215
p0.parnm=idevp8-lp17.aus.stglabs.ibm.com
p0.os=aix
p0.aix=7300-02-02-2420
+-----------------------------------------------------------------------------+
Checking interim fixes on the system ...
+-----------------------------------------------------------------------------+
ID  STATE LABEL      INSTALL TIME      UPDATED BY ABSTRACT
=== ===== ========== ================= ========== ======================================
1    S    is22026s1a 06/20/24        11:33:05   invscout fix for CVE-2024-27260
2    S    301002sa   06/20/24         11:33:37   ifix for openssl CVEs
3    S    81112ma    06/20/24        11:41:48   ifix for openssh Jan CVEs


Searching for AIX security fixes ...
+-----------------------------------------------------------------------------+
Recommended ifixes, please wait..parsing
===============================================================================
38408m9a        AIX is vulnerable to unauthorized file access and arbitrary code execution due to OpenSSH        https://aix.software.ibm.com/aix/efixes/security/openssh_fix15.tar
853sa   AIX is vulnerable to security restrictions bypass due to cURL libcurl (CVE-2024-0853)    https://aix.software.ibm.com/aix/efixes/security/curl_fix5.tar
CVE-2023-5363   AIX is vulnerable to a denial of service (CVE-2023-5678 CVE-2023-6129 CVE-2023-6237) and an attacker may obtain sensitive information (CVE-2023-5363) due to OpenSSL     https://aix.software.ibm.com/aix/efixes/security/openssl_fix40.tar

Vulnerability fixes are not downloaded

To check the availability of security interim fixes for the current operating system level and to download them to the default location, enter the following command:

#emgr_check_ifixes -D

Gathering system information
+-----------------------------------------------------------------------------+
p0.mtm=8286-42A
p0.fw=SV860_215
p0.parnm=idevp8-lp17.aus.stglabs.ibm.com
p0.os=aix
p0.aix=7300-02-02-2420
+-----------------------------------------------------------------------------+
Checking interim fixes on the system ...
+-----------------------------------------------------------------------------+
ID  STATE LABEL      INSTALL TIME      UPDATED BY ABSTRACT
=== ===== ========== ================= ========== ======================================
1    S    is22026s1a 06/20/24 11:33:05            invscout fix for CVE-2024-27260
2    S    301002sa   06/20/24 11:33:37            ifix for openssl CVEs
3    S    81112ma    06/20/24 11:41:48            ifix for openssh Jan CVEs


Searching for AIX security fixes ...
+-----------------------------------------------------------------------------+
Recommended ifixes, please wait..parsing
===============================================================================
38408m9a        AIX is vulnerable to unauthorized file access and arbitrary code execution due to OpenSSH        https://aix.software.ibm.com/aix/efixes/security/openssh_fix15.tar
853sa   AIX is vulnerable to security restrictions bypass due to cURL libcurl (CVE-2024-0853)    https://aix.software.ibm.com/aix/efixes/security/curl_fix5.tar
CVE-2023-5363   AIX is vulnerable to a denial of service (CVE-2023-5678 CVE-2023-6129 CVE-2023-6237) and an attacker may obtain sensitive information (CVE-2023-5363) due to OpenSSL     https://aix.software.ibm.com/aix/efixes/security/openssl_fix40.tar

Downloading 1 of 3 ...
Downloading fix: https://aix.software.ibm.com/aix/efixes/security/openssh_fix15.tar
+-----------------------------------------------------------------------------+

Performing certificate verification ...
OpenSSL success!
Interim fix openssh_fix15.tar has been downloaded to /tmp/ifix_14090742 directory.
+-----------------------------------------------------------------------------+

Downloading 2 of 3 ...
Downloading fix: https://aix.software.ibm.com/aix/efixes/security/curl_fix5.tar
+-----------------------------------------------------------------------------+

Performing certificate verification ...
OpenSSL success!
Interim fix curl_fix5.tar has been downloaded to /tmp/ifix_14090742 directory.
+-----------------------------------------------------------------------------+

Downloading 3 of 3 ...
Downloading fix: https://aix.software.ibm.com/aix/efixes/security/openssl_fix40.tar
+-----------------------------------------------------------------------------+

Performing certificate verification ...
OpenSSL success!
tail: 0652-046 Cannot write to output.
There is not enough space in the file system.
Interim fix openssl_fix40.tar has been downloaded to /tmp/ifix_14090742 directory.
+-----------------------------------------------------------------------------+

To check the availability of security interim fixes for the current operating system level and to download them at a specific location, enter the following command:

#emgr_check_ifixes -D -P /tmp

emgr_download_ifix

If you know the name and the URL of the interim fix you need to download (for example, curl_fix5 and its signature in the default directory), enter the following command:


# emgr_download_ifix -L https://aix.software.ibm.com/aix/efixes/security/curl_fix5.tar

Downloading fix: https://aix.software.ibm.com/aix/efixes/security/curl_fix5.tar
+-----------------------------------------------------------------------------+

Performing certificate verification ...
OpenSSL success!
Interim fix curl_fix5.tar has been downloaded to /tmp/ifix_14287324 directory.
+-----------------------------------------------------------------------------+

If you know the name and URL of the interim fix you need to download (for example, curl_fix5) and its signature at a specific location, enter the following command:

# emgr_download_ifix -L https://aix.software.ibm.com/aix/efixes/security/curl_fix5.tar
-P /tmp/curl_fix5

emgr_sec

If the interim fix is already present in the system, you can directly install it using the emgr_sec command. In the following example, the interim fix is contained within a .tar file. So, first extract the .tar file and then proceed to install the interim fix using the emgr_sec command.

# ls /tmp/curl_fix5
curl_fix5.tar

# tar -xvf curl_fix5.tar
x curl_fix5/853sa.240503.epkg.Z, 1289001 bytes, 2518 media blocks.
x curl_fix5/853sa.240503.epkg.Z.sig, 256 bytes, 1 media blocks.
x curl_fix5/Advisory.asc, 8568 bytes, 17 media blocks.
x curl_fix5/Advisory.asc.sig, 256 bytes, 1 media blocks.

# ls /tmp/curl_fix5
curl_fix5                curl_fix5.tar

# cd /tmp/curl_fix5
# ls
853sa.240503.epkg.Z      853sa.240503.epkg.Z.sig  Advisory.asc             Advisory.asc.sig

# emgr_sec 853sa.240503.epkg.Z
+-----------------------------------------------------------------------------+
Verying signature of ifix
+-----------------------------------------------------------------------------+
ifix: 853sa.240503.epkg.Z
Signature file found
Certificate found
Verified OK
Signature verification passed for 853sa.240503.epkg.Z ...
Installing ifix 853sa.240503.epkg.Z ...
+-----------------------------------------------------------------------------+
Efix Manager Initialization
+-----------------------------------------------------------------------------+
Initializing log /var/adm/ras/emgr.log ...
Efix package file is: /tmp/ifix_14090742/curl_fix5/853sa.240503.epkg.Z
MD5 generating command is /usr/bin/csum
MD5 checksum is 3dce28faebd2858fe13b737d791b72fa
Accessing efix metadata ...
Processing efix label "853sa" ...
Verifying efix control file ...

+-----------------------------------------------------------------------------+
Installp Prerequisite Verification
+-----------------------------------------------------------------------------+
Verifying prerequisite file ...
Checking prerequisites ...

Prerequisite Number: 1
   Fileset: oss.lib.libcurl
   Minimal Level: 8.5.0.0
   Maximum Level: 8.5.0.0
   Actual Level: 8.5.0.0
   Type: PREREQ
   Requisite Met: yes

All prerequisites have been met.

+-----------------------------------------------------------------------------+
Processing APAR reference file
+-----------------------------------------------------------------------------+
APAR reference set to NONE.  Interim fix is not enabled for automatic removal.

+-----------------------------------------------------------------------------+
Efix Attributes
+-----------------------------------------------------------------------------+
LABEL:            853sa
PACKAGING DATE:   Fri May  3 00:25:40 CDT 2024
ABSTRACT:         ifix for libcurl CVE-2024-0853
PACKAGER VERSION: 7
VUID:             00F787C74C00050300054024
REBOOT REQUIRED:  no
BUILD BOOT IMAGE: no
LU CAPABLE:       yes
PRE-REQUISITES:   yes
SUPERSEDE:        no
PACKAGE LOCKS:    no
E2E PREREQS:      no
FIX TESTED:       no
ALTERNATE PATH:   None
EFIX FILES:       1

Install Scripts:
   PRE_INSTALL:   no
   POST_INSTALL:  no
   PRE_REMOVE:    no
   POST_REMOVE:   no

File Number:      1
   LOCATION:      /usr/opt/oss/lib/libcurl.a
   FILE TYPE:     Standard (file or executable)
   INSTALLER:     installp
   SIZE:          5608
   ACL:           DEFAULT
   CKSUM:         19911
   PACKAGE:       oss.lib.libcurl
   MOUNT INST:    no

+-----------------------------------------------------------------------------+
Efix Description
+-----------------------------------------------------------------------------+
ifix for libcurl-8.5.0 CVE-2024-0853

+-----------------------------------------------------------------------------+
Efix Lock Management
+-----------------------------------------------------------------------------+
Checking locks for file /usr/opt/oss/lib/libcurl.a ...

All files have passed lock checks.

+-----------------------------------------------------------------------------+
Space Requirements
+-----------------------------------------------------------------------------+
Checking space requirements ...

Space statistics (in 512 byte-blocks):
File system: /usr, Free: 84320, Required: 7976, Deficit: 0.
File system: /tmp, Free: 2095960, Required: 9013, Deficit: 0.

+-----------------------------------------------------------------------------+
Efix Installation Setup
+-----------------------------------------------------------------------------+
Unpacking efix package file ...
Initializing efix installation ...

+-----------------------------------------------------------------------------+
Efix State
+-----------------------------------------------------------------------------+
Setting efix state to: INSTALLING

+-----------------------------------------------------------------------------+
File Archiving
+-----------------------------------------------------------------------------+
Saving all files that will be replaced ...
Save directory is: /usr/emgrdata/efixdata/853sa/save
File 1: Saving /usr/opt/oss/lib/libcurl.a as EFSAVE1 ...

+-----------------------------------------------------------------------------+
Efix File Installation
+-----------------------------------------------------------------------------+
Installing all efix files:
Installing efix file #1 (File: /usr/opt/oss/lib/libcurl.a) ...

Total number of efix files installed is 1.
All efix files installed successfully.

+-----------------------------------------------------------------------------+
Package Locking
+-----------------------------------------------------------------------------+
Processing package locking for all files.
File 1: locking installp fileset oss.lib.libcurl.

All package locks processed successfully.

+-----------------------------------------------------------------------------+
Reboot Processing
+-----------------------------------------------------------------------------+
Reboot is not required by this efix package.

+-----------------------------------------------------------------------------+
Efix State
+-----------------------------------------------------------------------------+
Setting efix state to: STABLE

+-----------------------------------------------------------------------------+
Operation Summary
+-----------------------------------------------------------------------------+
Log file is /var/adm/ras/emgr.log

EPKG NUMBER       LABEL               OPERATION              RESULT
===========       ==============      =================      ==============
1                 853sa               INSTALL                SUCCESS

Return Status = SUCCESS
Done

emgr_sec_patch

To install secure interim fixes that are archived in tar format, use the emgr_sec_patch command.

# emgr_sec_patch openssl_fix40.tar
Downloaded Tar file name is: //openssl_fix40.tar
+-----------------------------------------------------------------------------+
Verifying contents of //openssl_fix40.tar
+-----------------------------------------------------------------------------+
+-----------------------------------------------------------------------------+
Verifying integrity of Advisory.asc
+-----------------------------------------------------------------------------+
Advisory.asc integrity verification passed
+-----------------------------------------------------------------------------+
Checking System Level Prerequisites
+-----------------------------------------------------------------------------+
calling emgr -p -e /tmp/emgr_8519984/openssl_fix40/1022107a.240107.epkg.Z
Skipping ifix
See /var/adm/ras/emgr.log for more details
+-----------------------------------------------------------------------------+
Checking System Level Prerequisites
+-----------------------------------------------------------------------------+
calling emgr -p -e /tmp/emgr_8519984/openssl_fix40/1112200a.240109.epkg.Z
Skipping ifix
See /var/adm/ras/emgr.log for more details
+-----------------------------------------------------------------------------+
Checking System Level Prerequisites
+-----------------------------------------------------------------------------+
calling emgr -p -e /tmp/emgr_8519984/openssl_fix40/1122200a.240110.epkg.Z
Skipping ifix
See /var/adm/ras/emgr.log for more details
/tmp/emgr_8519984/openssl_fix40/301002sa.240122.epkg.Z is already installed
+-----------------------------------------------------------------------------+
Checking System Level Prerequisites
+-----------------------------------------------------------------------------+
calling emgr -p -e /tmp/emgr_8519984/openssl_fix40/fips2108a.240108.epkg.Z
Skipping ifix
See /var/adm/ras/emgr.log for more details

Summary

This tutorial explained how to manage IBM AIX system security interim fixes using specific commands, such as emgr_check_ifixes for scanning, validating, and downloading fixes, emgr_sec for installing fixes with digital signature validation, and emgr_sec_patch for handling and installing fixes archived in the tar format. The tutorial detailed a stage-wise workflow for identifying, downloading, and installing these fixes, highlighting the importance of signature and checksum verification for security.

Future enhancement

To enhance usability for corporate AIX customers who often use a proxy to control internet access, it would be beneficial to add proxy support to the emgr_check_ifixes and emgr_download_ifix commands. Currently, these commands only function with direct internet access, limiting their effectiveness in corporate environments. Implementing proxy support would make these commands more accessible and user-friendly for corporate customers.