PT-2015-2782 · Ibm · Websphere Mq

Published 2015-07-01 · Updated 2016-12-30 · CVE-2015-1967

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions WebSphere MQ versions prior to 8.0.0.3

Description The issue is related to the MQ Explorer component in IBM WebSphere MQ, which does not properly handle the absence of the compatibility-mode option. This allows remote attackers to obtain sensitive information by sniffing the network for a session in which TLS is not used. The vulnerability can be exploited by analyzing network traffic, potentially giving attackers access to protected information.

Recommendations For versions prior to 8.0.0.3, update to version 8.0.0.3 or later to resolve the issue. As a temporary workaround, consider enabling TLS for all sessions to minimize the risk of exploitation. Restrict access to sensitive information and limit network traffic analysis to prevent potential attacks.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2015-12147

CVE-2015-1967

Affected Products

Websphere Mq

References · 4

• http://www-01.ibm.com/support/docview.wss?uid=swg21960491 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1967 · Security Note
• https://bdu.fstec.ru/vul/2015-12147 · Security Note
• http://securitytracker.com/id/1032772 · Note