Security Bulletin: Vulnerability in IBM Java Runtime affects IBM MQ Light (CVE-2016-3485)

Summary

There is a vulnerability in IBM® Runtime Environment Java™ Version 8 and earlier releases that is used by IBM MQ Light.

This issue was disclosed as part of the IBM Java SDK updates in July 2016.

IBM MQ Light 1.0.6 has addressed the applicable CVE.

Vulnerability Details

CVEID: CVE-2016-3485 DESCRIPTION: An unspecified vulnerability related to the Networking component has no confidentiality impact, low integrity impact, and no availability impact.
CVSS Base Score: 2.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/115273 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

The vulnerability affects users of IBM MQ Light 1.0, 1.0.0.1, 1.0.0.2, 1.0.2, 1.0.3 on all platforms

Remediation/Fixes

This issue has been addressed by IBM MQ Light 1.0.6

Download and install the latest MQ Light Server appropriate for your platform: https://developer.ibm.com/messaging/mq-light/.

The following link describes how to re-use the data from your existing installation:
_http://www.ibm.com/support/knowledgecenter/SSBJCR_1.0.0/com.ibm.mq.koa.doc/tmql_data.htm _.

Workarounds and Mitigations

None.