PT-2017-7614 · Ibm · Ibm Websphere Mq Jms

Matthias Kaiser · Published 2017-02-15 · Updated 2017-07-27 · CVE-2016-0360

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Websphere MQ JMS versions 7.0.1, 7.1, 7.5, 8.0, and 9.0

Description The issue allows a malicious user to execute arbitrary Java code by adding vulnerable classes to the classpath, as the JMS client provides classes that deserialize objects from untrusted sources.

Recommendations For IBM Websphere MQ JMS version 7.0.1, update to a fixed version to prevent arbitrary Java code execution. For IBM Websphere MQ JMS version 7.1, update to a fixed version to prevent arbitrary Java code execution. For IBM Websphere MQ JMS version 7.5, update to a fixed version to prevent arbitrary Java code execution. For IBM Websphere MQ JMS version 8.0, update to a fixed version to prevent arbitrary Java code execution. For IBM Websphere MQ JMS version 9.0, update to a fixed version to prevent arbitrary Java code execution.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2016-0360

Affected Products

Ibm Websphere Mq Jms

References · 5

• https://osv.dev/vulnerability/CVE-2016-0360 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21983457 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0360 · Security Note
• http://securityfocus.com/bid/95317 · Note
• http://securitytracker.com/id/1037561 · Note