PT-2024-2164 · Ibm · Ibm Mq Appliance+1

Published 2024-03-01 · Updated 2024-03-04 · CVE-2024-25016

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions IBM MQ and IBM MQ Appliance versions 9.0 through 9.3 CD

Description The issue is related to insufficient input validation, which can be exploited by a remote attacker to cause a denial of service. This is due to incorrect buffering logic. A remote unauthenticated attacker may cause a denial of service.

Recommendations For IBM MQ and IBM MQ Appliance versions 9.0 through 9.3 CD, update to a version that includes the fix for the incorrect buffering logic issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Resource Release

RCE

Weakness Enumeration

CWE-404

CWE-20

Related Identifiers

BDU:2024-02076

CVE-2024-25016

Affected Products

Ibm Mq

Ibm Mq Appliance

References · 9

• https://exchange.xforce.ibmcloud.com/vulnerabilities/281279 · Vendor Advisory
• https://ibm.com/support/pages/node/7123139 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02076 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-25016 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25016 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1764175071055147216 · Twitter Post
• https://twitter.com/CVEnew/status/1764129986192003096 · Twitter Post
• https://twitter.com/cracbot/status/1764520708934177030 · Twitter Post
• https://t.me/cvenotify/72876 · Telegram Post