#VU14026 Improper input validation in IBM MQ - CVE-2018-1503
Published: July 27, 2018 / Updated: July 27, 2018
Vulnerability identifier: #VU14026
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-1503
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
IBM MQ
IBM MQ
Software vendor:
IBM Corporation
IBM Corporation
Description
The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.
The vulnerability exists due to an error when processing malicious input. A remote attacker can send messages containing specially crafted headers to the target RCVR or CLUSRCVR type channels to cause the system to enter retry status and cause transmission of subsequent messages to fail.
Remediation
Update to version 8.0.0.10, 9.0.0.4.