Lucene search

K
ibmIBM631B242F681F4E00FF3934D942BDEFCF0928F76941A9832590D69B2AC292137C
HistoryFeb 17, 2021 - 10:09 a.m.

Security Bulletin: IBM MQ Appliance is affected by multiple BIND vulnerabilities (CVE-2020-8622, CVE-2020-8623, CVE-2020-8624)

2021-02-1710:09:26
www.ibm.com
17
ibm mq appliance
bind vulnerabilities
apar it35457
version 9.1 lts
version 9.2 cd
version 9.2 lts
version 9.1 cd

EPSS

0.024

Percentile

90.1%

Summary

IBM MQ Appliance has resolved multiple BIND vulnerabilities.

Vulnerability Details

CVEID:CVE-2020-8622
**DESCRIPTION:**ISC BIND is vulnerable to a denial of service, caused by an assertion failure when attempting to verify a truncated response to a TSIG-signed request. By sending a specially-crafted request, a remote authenticated attacker could exploit this vulnerability to cause the server to exit.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/187060 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2020-8623
**DESCRIPTION:**ISC BIND is vulnerable to a denial of service, caused by an assertion failure when built with “–enable-native-pkcs11”. By sending a specially-crafted packet, a remote attacker could exploit this vulnerability to cause the server to crash.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/187061 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2020-8624
**DESCRIPTION:**ISC BIND could allow a remote authenticated attacker to bypass security restrictions, caused by the failure to properly enforce the update-policy rules of type “subdomain”. By sending a specially-crafted request, an attacker could exploit this vulnerability to update other contents of the zone.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/187062 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
IBM MQ Appliance 9.1 LTS
IBM MQ Appliance 9.2 CD
IBM MQ Appliance 9.2 LTS
IBM MQ Appliance 9.1 CD

Remediation/Fixes

This vulnerability is addressed by APAR IT35457.

IBM MQ Appliance 9.1 LTS

Apply ifix for APAR IT35457, or later maintenance.

IBM MQ Appliance 9.1 CD

Upgrade to IBM MQ CD 9.2.1 with iFix for APAR IT35457, or later maintenance.

IBM MQ Appliance 9.2 LTS

Apply ifix for APAR IT35457, or later maintenance.

IBM MQ Appliance 9.2 CD

Apply ifix for APAR IT35457, or later maintenance.

Workarounds and Mitigations

None