PT-2015-4509 · Ibm · Ibm Websphere Mq Internet Pass-Thru

Published 2015-06-28 · Updated 2017-09-23 · CVE-2015-0173

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere MQ Internet Pass-Thru versions prior to 2.1.0.2

Description The issue affects the HTTP connection-management functionality when HTTPS is disabled, leading to improper generation of MQIPT Session IDs. This makes it easier for remote attackers to bypass intended restrictions on MQ message data by predicting an ID value.

Recommendations For versions prior to 2.1.0.2, update to version 2.1.0.2 or later to resolve the issue. As a temporary workaround, consider enabling HTTPS to minimize the risk of exploitation. Restrict access to the HTTP connection-management functionality until the issue is resolved.

Fix

Weakness Enumeration

CWE-17

Related Identifiers

CVE-2015-0173

Affected Products

Ibm Websphere Mq Internet Pass-Thru

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-0173 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21699547 · Vendor Advisory
• http://securitytracker.com/id/1032630 · Note