PT-2014-7051 · Ibm · Websphere Mq

Published 2014-10-19 · Updated 2017-09-08 · CVE-2014-6116

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WebSphere MQ version 8.0.0.1 before p000-001-L140910

Description The issue allows remote attackers to bypass authentication. This is achieved by setting the JAASConfig property in an MQTT client configuration.

Recommendations For WebSphere MQ version 8.0.0.1, apply the patch p000-001-L140910 to resolve the issue. As a temporary workaround, consider restricting access to the Telemetry Component until the patch is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-6116

Affected Products

Websphere Mq

References · 4

• http://www-01.ibm.com/support/docview.wss?uid=swg21686210 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-6116 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96213 · Note
• http://secunia.com/advisories/61064 · Note