PT-2018-12135 · Ibm · Websphere Mq

Published 2018-06-26 · Updated 2019-10-09 · CVE-2018-1374

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IBM WebSphere MQ versions 7.1.0.0 through 7.1.0.9 IBM WebSphere MQ versions 7.5.0.0 through 7.5.0.8 IBM WebSphere MQ versions 8.0.0.0 through 8.0.0.8 IBM WebSphere MQ versions 9.0.0.0 through 9.0.0.2 IBM WebSphere MQ versions 9.0.0 through 9.0.4

Description A client connecting to a Queue Manager could cause a SIGSEGV in the Channel process amqrmppa.

Recommendations For IBM WebSphere MQ versions 7.1.0.0 through 7.1.0.9, update to a version outside of this range to resolve the issue. For IBM WebSphere MQ versions 7.5.0.0 through 7.5.0.8, update to a version outside of this range to resolve the issue. For IBM WebSphere MQ versions 8.0.0.0 through 8.0.0.8, update to a version outside of this range to resolve the issue. For IBM WebSphere MQ versions 9.0.0.0 through 9.0.0.2, update to a version outside of this range to resolve the issue. For IBM WebSphere MQ versions 9.0.0 through 9.0.4, update to a version outside of this range to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-1374

Affected Products

Websphere Mq

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-1374 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1374 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg22012982 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/137775 · Note