PT-2015-4480 · Ibm · Ibm Websphere Message Broker Toolkit+2

Published 2015-06-28 · Updated 2015-06-29 · CVE-2015-0118

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Message Broker Toolkit versions 7.0.0 through 7.0.7 before IF2 IBM WebSphere Message Broker Toolkit version 8.0.0 through 8.0.5 before IF1 IBM Integration Toolkit versions 9.0.0 through 9.0.3 before IF1

Description The software is distributed with MQ client JAR files that support only weak TLS ciphers. This could make it easier for remote attackers to obtain sensitive information by sniffing the network during a connection to an Integration Bus node.

Recommendations For IBM WebSphere Message Broker Toolkit versions 7.0.0 through 7.0.7 before IF2, update to version 7007 IF2 or later. For IBM WebSphere Message Broker Toolkit version 8.0.0 through 8.0.5 before IF1, update to version 8005 IF1 or later. For IBM Integration Toolkit versions 9.0.0 through 9.0.3 before IF1, update to version 9003 IF1 or later.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2015-0118

Affected Products

Ibm Integration Toolkit

Ibm Websphere Message Broker Toolkit

Mq

References · 3

• http://www-01.ibm.com/support/docview.wss?uid=swg21957998 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0118 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT05725 · Vendor Advisory