PT-2008-1666 · Ibm · Websphere Mq

Published 2008-03-09 · Updated 2008-11-15 · CVE-2007-6705

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:L/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebSphere MQ XA versions 5.3 before FP13 WebSphere MQ XA versions 6.0.x before 6.0.2.1

Description The issue allows local users to duplicate an arbitrary handle and possibly hijack an arbitrary process when the client is running in an MTS or a COM+ environment and connects to a queue manager, due to the granting of the PROCESS DUP HANDLE privilege to the Everyone group.

Recommendations For WebSphere MQ XA versions 5.3 before FP13, apply FP13 to resolve the issue. For WebSphere MQ XA versions 6.0.x before 6.0.2.1, update to version 6.0.2.1 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-6705

Affected Products

Websphere Mq

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-6705 · Security Note
• http://www-1.ibm.com/support/docview.wss?uid=swg1IC50431 · Vendor Advisory
• http://osvdb.org/43167 · Note
• http://securitytracker.com/id?1019529 · Note