Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MQ Light (CVE-2016-3426)

Summary

There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 Service Refresh 9 Fix Pack 31 and earlier releases, and IBM® Runtime Environment Java™ Version 7R1 Service Refresh 3 Fix Pack 31 and earlier releases, that is used by IBM MQ Light. These issues were disclosed as part of the IBM Java SDK updates in April 2016.

Vulnerability Details

CVEID: CVE-2016-3426**
DESCRIPTION:** An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the JCE component could allow a remote attacker to obtain sensitive information resulting in a partial confidentiality impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/112457&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Affected Products and Versions

The vulnerabilities affect users of IBM MQ Light 1.0, 1.0.0.1, 1.0.0.2, 1.0.2 on all platforms

Remediation/Fixes

This issue has been addressed by IBM MQ Light 1.0.3

Download and install the latest MQ Light Server appropriate for your platform: https://developer.ibm.com/messaging/mq-light/.

The following link describes how to re-use the data from your existing installation:
_http://www.ibm.com/support/knowledgecenter/SSBJCR_1.0.0/com.ibm.mq.koa.doc/tmql_data.htm _.

Workarounds and Mitigations

None