PT-2015-4509 · Ibm · Ibm Websphere Mq Internet Pass-Thru

Publicado 2015-06-28 · Atualizado 2017-09-23 · CVE-2015-0173

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere MQ Internet Pass-Thru versions prior to 2.1.0.2

Description The issue affects the HTTP connection-management functionality when HTTPS is disabled, leading to improper generation of MQIPT Session IDs. This makes it easier for remote attackers to bypass intended restrictions on MQ message data by predicting an ID value.

Recommendations For versions prior to 2.1.0.2, update to version 2.1.0.2 or later to resolve the issue. As a temporary workaround, consider enabling HTTPS to minimize the risk of exploitation. Restrict access to the HTTP connection-management functionality until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-17

Identificadores relacionados

CVE-2015-0173

Produtos afetados

Ibm Websphere Mq Internet Pass-Thru

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-0173 · Nota de Segurança
• http://securitytracker.com/id/1032630 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg21699547 · Aviso do Fabricante