Multiple vulnerabilities in IBM MQ



Published: 2018-06-14
Risk Low
Patch available YES
Number of vulnerabilities 7
CVE ID CVE-2016-0705
CVE-2017-3732
CVE-2017-3736
CVE-2018-1428
CVE-2018-1427
CVE-2018-1426
CVE-2018-1447
CWE ID CWE-415
CWE-310
CWE-327
CWE-190
CWE-338
CWE-521
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
IBM MQ
Server applications / Other server solutions

Vendor IBM Corporation

Security Advisory

1) Double free error

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-0705

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.

The weakness exists due to double-free error when parsing DSA private keys. A remote attacker can trigger memory corruption and cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM MQ: 7.0.1.0, 7.0.1.1, 7.0.1.2, 7.0.1.3, 7.0.1.4, 7.0.1.5, 7.0.1.6, 7.0.1.7, 7.0.1.8, 7.0.1.9, 7.0.1.10, 7.0.1.11, 7.0.1.12, 7.0.1.13, 7.0.1.14, 7.1, 7.1.0.1, 7.1.0.2, 7.1.0.3, 7.1.0.4, 7.1.0.5, 7.1.0.6, 7.1.0.7, 7.1.0.8, 7.1.0.9, 7.5, 7.5.0.1, 7.5.0.2, 7.5.0.3, 7.5.0.4, 7.5.0.5, 7.5.0.6, 7.5.0.7, 7.5.0.8, 8.0.0.0, 8.0.0.1, 8.0.0.2, 8.0.0.3, 8.0.0.4, 8.0.0.5, 8.0.0.6, 8.0.0.7, 8.0.0.8, 9.0.0, 9.0.0.1, 9.0.0.2, 9.0.1, 9.0.2, 9.0.3, 9.0.4

CPE External links

http://www-01.ibm.com/support/docview.wss?uid=swg22014651&myns=swgws&mynp=OCSS5K6E&mynp=OCSSYHRD&mynp=OCSSFKSJ&mync=E&cm_sp=swgws-_-OCSS5K6E-OCSSYHRD-OCSSFKSJ-_-E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-3732

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to propagating error in the x86_64 Montgomery squaring procedure. A remote attacker with access to unpatched vulnerable system that uses a shared private key with Diffie-Hellman (DH) parameters set can gain unauthorized access to sensitive private key information.

According to vendor’s advisory, this vulnerability is unlikely to be exploited in real-world attacks, as it requires significant resources and online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients.

Vulnerability exploitation against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM MQ: 7.0.1.0, 7.0.1.1, 7.0.1.2, 7.0.1.3, 7.0.1.4, 7.0.1.5, 7.0.1.6, 7.0.1.7, 7.0.1.8, 7.0.1.9, 7.0.1.10, 7.0.1.11, 7.0.1.12, 7.0.1.13, 7.0.1.14, 7.1, 7.1.0.1, 7.1.0.2, 7.1.0.3, 7.1.0.4, 7.1.0.5, 7.1.0.6, 7.1.0.7, 7.1.0.8, 7.1.0.9, 7.5, 7.5.0.1, 7.5.0.2, 7.5.0.3, 7.5.0.4, 7.5.0.5, 7.5.0.6, 7.5.0.7, 7.5.0.8, 8.0, 8.0.0.0, 8.0.0.1, 8.0.0.2, 8.0.0.3, 8.0.0.4, 8.0.0.5, 8.0.0.6, 8.0.0.7, 8.0.0.8, 9.0.0, 9.0.0.1, 9.0.0.2, 9.0.1, 9.0.2, 9.0.3, 9.0.4

CPE External links

http://www-01.ibm.com/support/docview.wss?uid=swg22014651&myns=swgws&mynp=OCSS5K6E&mynp=OCSSYHRD&mynp=OCSSFKSJ&mync=E&cm_sp=swgws-_-OCSS5K6E-OCSSYHRD-OCSSFKSJ-_-E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Carry propagation issue

Risk: Low

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2017-3736

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to decrypt data.

The vulnerability exists due to carry propagating bug in the x86_64 Montgomery squaring procedure (bn_sqrx8x_internal). A remote attacker can decrypt encrypted data. The vulnerability affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM MQ: 7.0.1.0, 7.0.1.1, 7.0.1.2, 7.0.1.3, 7.0.1.4, 7.0.1.5, 7.0.1.6, 7.0.1.7, 7.0.1.8, 7.0.1.9, 7.0.1.10, 7.0.1.11, 7.0.1.12, 7.0.1.13, 7.0.1.14, 7.1, 7.1.0.1, 7.1.0.2, 7.1.0.3, 7.1.0.4, 7.1.0.5, 7.1.0.6, 7.1.0.7, 7.1.0.8, 7.1.0.9, 7.5, 7.5.0.1, 7.5.0.2, 7.5.0.3, 7.5.0.4, 7.5.0.5, 7.5.0.6, 7.5.0.7, 7.5.0.8, 8.0.0.0, 8.0.0.1, 8.0.0.2, 8.0.0.3, 8.0.0.4, 8.0.0.5, 8.0.0.6, 8.0.0.7, 8.0.0.8, 9.0.0, 9.0.0.1, 9.0.0.2, 9.0.1, 9.0.2, 9.0.3, 9.0.4

CPE External links

http://www-01.ibm.com/support/docview.wss?uid=swg22014651&myns=swgws&mynp=OCSS5K6E&mynp=OCSSYHRD&mynp=OCSSFKSJ&mync=E&cm_sp=swgws-_-OCSS5K6E-OCSSYHRD-OCSSFKSJ-_-E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use of a broken or risky cryptographic algorithm

Risk: Low

CVSSv3.1: 5.4 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2018-1428

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Exploit availability: No

Description

The vulnerability allows a local unauthenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to IBM GSKit uses weaker than expected cryptographic algorithms. A local attacker can gain access to potentially sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM MQ: 7.0.1.0, 7.0.1.1, 7.0.1.2, 7.0.1.3, 7.0.1.4, 7.0.1.5, 7.0.1.6, 7.0.1.7, 7.0.1.8, 7.0.1.9, 7.0.1.10, 7.0.1.11, 7.0.1.12, 7.0.1.13, 7.0.1.14, 7.1, 7.1.0.1, 7.1.0.2, 7.1.0.3, 7.1.0.4, 7.1.0.5, 7.1.0.6, 7.1.0.7, 7.1.0.8, 7.1.0.9, 7.5, 7.5.0.1, 7.5.0.2, 7.5.0.3, 7.5.0.4, 7.5.0.5, 7.5.0.6, 7.5.0.7, 7.5.0.8, 8.0.0.0, 8.0.0.1, 8.0.0.2, 8.0.0.3, 8.0.0.4, 8.0.0.5, 8.0.0.6, 8.0.0.7, 8.0.0.8, 9.0.0, 9.0.0.1, 9.0.0.2, 9.0.1, 9.0.2, 9.0.3, 9.0.4

CPE External links

http://www-01.ibm.com/support/docview.wss?uid=swg22014651&myns=swgws&mynp=OCSS5K6E&mynp=OCSSYHRD&mynp=OCSSFKSJ&mync=E&cm_sp=swgws-_-OCSS5K6E-OCSSYHRD-OCSSFKSJ-_-E

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Integer overflow

Risk: Low

CVSSv3.1: 5.4 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2018-1427

CWE-ID: CWE-190 - Integer Overflow or Wraparound

Exploit availability: No

Description

The vulnerability allows a local unauthenticated attacker to cause DoS condition on the target system.

The weakness exists due to IBM GSKit contains several environment variables. A local attacker can cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM MQ: 7.0.1.0, 7.0.1.1, 7.0.1.2, 7.0.1.3, 7.0.1.4, 7.0.1.5, 7.0.1.6, 7.0.1.7, 7.0.1.8, 7.0.1.9, 7.0.1.10, 7.0.1.11, 7.0.1.12, 7.0.1.13, 7.0.1.14, 7.1, 7.1.0.1, 7.1.0.2, 7.1.0.3, 7.1.0.4, 7.1.0.5, 7.1.0.6, 7.1.0.7, 7.1.0.8, 7.1.0.9, 7.5, 7.5.0.1, 7.5.0.2, 7.5.0.3, 7.5.0.4, 7.5.0.5, 7.5.0.6, 7.5.0.7, 7.5.0.8, 8.0.0.0, 8.0.0.1, 8.0.0.2, 8.0.0.3, 8.0.0.4, 8.0.0.5, 8.0.0.6, 8.0.0.7, 8.0.0.8, 9.0.0, 9.0.0.1, 9.0.0.2, 9.0.1, 9.0.2, 9.0.3, 9.0.4

CPE External links

http://www-01.ibm.com/support/docview.wss?uid=swg22014651&myns=swgws&mynp=OCSS5K6E&mynp=OCSSYHRD&mynp=OCSSFKSJ&mync=E&cm_sp=swgws-_-OCSS5K6E-OCSSYHRD-OCSSFKSJ-_-E

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use of cryptographically weak PRNG

Risk: Low

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2018-1426

CWE-ID: CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information and write arbitrary files on the target system.

The weakness exists due to IBM GSKit duplicates the PRNG state across fork() system calls when multiple ICC instances are loaded which can result in duplicate Session IDs and a risk of duplicate key material. A remote attacker can gain access to potentially sensitive information and write arbitrary files.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM MQ: 7.0.1.0, 7.0.1.1, 7.0.1.2, 7.0.1.3, 7.0.1.4, 7.0.1.5, 7.0.1.6, 7.0.1.7, 7.0.1.8, 7.0.1.9, 7.0.1.10, 7.0.1.11, 7.0.1.12, 7.0.1.13, 7.0.1.14, 7.1, 7.1.0.1, 7.1.0.2, 7.1.0.3, 7.1.0.4, 7.1.0.5, 7.1.0.6, 7.1.0.7, 7.1.0.8, 7.1.0.9, 7.5, 7.5.0.1, 7.5.0.2, 7.5.0.3, 7.5.0.4, 7.5.0.5, 7.5.0.6, 7.5.0.7, 7.5.0.8, 8.0.0.0, 8.0.0.1, 8.0.0.2, 8.0.0.3, 8.0.0.4, 8.0.0.5, 8.0.0.6, 8.0.0.7, 8.0.0.8, 9.0.0, 9.0.0.1, 9.0.0.2, 9.0.1, 9.0.2, 9.0.3, 9.0.4

CPE External links

http://www-01.ibm.com/support/docview.wss?uid=swg22014651&myns=swgws&mynp=OCSS5K6E&mynp=OCSSYHRD&mynp=OCSSFKSJ&mync=E&cm_sp=swgws-_-OCSS5K6E-OCSSYHRD-OCSSFKSJ-_-E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Weak passwords requirements

Risk: Low

CVSSv3.1: 4.5 [CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2018-1447

CWE-ID: CWE-521 - Weak Password Requirements

Exploit availability: No

Description

The vulnerability allows a local unauthenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to the GSKit CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. A local attacker can gain access to potentially sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM MQ: 7.0.1.0, 7.0.1.1, 7.0.1.2, 7.0.1.3, 7.0.1.4, 7.0.1.5, 7.0.1.6, 7.0.1.7, 7.0.1.8, 7.0.1.9, 7.0.1.10, 7.0.1.11, 7.0.1.12, 7.0.1.13, 7.0.1.14, 7.1, 7.1.0.1, 7.1.0.2, 7.1.0.3, 7.1.0.4, 7.1.0.5, 7.1.0.6, 7.1.0.7, 7.1.0.8, 7.1.0.9, 7.5, 7.5.0.1, 7.5.0.2, 7.5.0.3, 7.5.0.4, 7.5.0.5, 7.5.0.6, 7.5.0.7, 7.5.0.8, 8.0.0.0, 8.0.0.1, 8.0.0.2, 8.0.0.3, 8.0.0.4, 8.0.0.5, 8.0.0.6, 8.0.0.7, 8.0.0.8, 9.0.0, 9.0.0.1, 9.0.0.2, 9.0.1, 9.0.2, 9.0.3, 9.0.4

CPE External links

http://www-01.ibm.com/support/docview.wss?uid=swg22014651&myns=swgws&mynp=OCSS5K6E&mynp=OCSSYHRD&mynp=OCSSFKSJ&mync=E&cm_sp=swgws-_-OCSS5K6E-OCSSYHRD-OCSSFKSJ-_-E

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###