PT-2017-7614 · Ibm · Ibm Websphere Mq Jms

Matthias Kaiser · Publicado 2017-02-15 · Atualizado 2017-07-27 · CVE-2016-0360

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Websphere MQ JMS versions 7.0.1, 7.1, 7.5, 8.0, and 9.0

Description The issue allows a malicious user to execute arbitrary Java code by adding vulnerable classes to the classpath, as the JMS client provides classes that deserialize objects from untrusted sources.

Recommendations For IBM Websphere MQ JMS version 7.0.1, update to a fixed version to prevent arbitrary Java code execution. For IBM Websphere MQ JMS version 7.1, update to a fixed version to prevent arbitrary Java code execution. For IBM Websphere MQ JMS version 7.5, update to a fixed version to prevent arbitrary Java code execution. For IBM Websphere MQ JMS version 8.0, update to a fixed version to prevent arbitrary Java code execution. For IBM Websphere MQ JMS version 9.0, update to a fixed version to prevent arbitrary Java code execution.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2016-0360

Produtos afetados

Ibm Websphere Mq Jms

Referências · 5

• http://securityfocus.com/bid/95317 · Nota
• https://osv.dev/vulnerability/CVE-2016-0360 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg21983457 · Aviso do Fabricante
• http://securitytracker.com/id/1037561 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-0360 · Nota de Segurança