PT-2015-4480 · Ibm · Ibm Websphere Message Broker Toolkit+2

Publicado 2015-06-28 · Atualizado 2015-06-29 · CVE-2015-0118

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Message Broker Toolkit versions 7.0.0 through 7.0.7 before IF2 IBM WebSphere Message Broker Toolkit version 8.0.0 through 8.0.5 before IF1 IBM Integration Toolkit versions 9.0.0 through 9.0.3 before IF1

Description The software is distributed with MQ client JAR files that support only weak TLS ciphers. This could make it easier for remote attackers to obtain sensitive information by sniffing the network during a connection to an Integration Bus node.

Recommendations For IBM WebSphere Message Broker Toolkit versions 7.0.0 through 7.0.7 before IF2, update to version 7007 IF2 or later. For IBM WebSphere Message Broker Toolkit version 8.0.0 through 8.0.5 before IF1, update to version 8005 IF1 or later. For IBM Integration Toolkit versions 9.0.0 through 9.0.3 before IF1, update to version 9003 IF1 or later.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2015-0118

Produtos afetados

Ibm Integration Toolkit

Ibm Websphere Message Broker Toolkit

Mq

Referências · 3

• http://www-01.ibm.com/support/docview.wss?uid=swg21957998 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-0118 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT05725 · Aviso do Fabricante