Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM WebSphere MQ (CVE-2016-0264, CVE-2016-3426 and CVE-2016-3427)

Summary

There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 6 and 7 that are used by IBM WebSphere MQ. These issues were disclosed as part of the IBM Java SDK updates in April 2016.

Vulnerability Details

If you run your own Java code using the IBM Java Runtime delivered with this product, you should evaluate your code to determine whether the complete list of vulnerabilities are applicable to your code. For a complete list of vulnerabilities please refer to the Reference section for more information.

CVEID: CVE-2016-0264** *DESCRIPTION: A buffer overflow vulnerability in the IBM JVM facilitates arbitrary code execution under certain limited circumstances.
CVSS Base Score: 5.6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/110867 for the current score
CVSS Environmental Score: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2016-3426** *DESCRIPTION: An unspecified vulnerability related to the JCE component could allow a remote attacker to obtain sensitive information resulting in a partial confidentiality impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112457 for the current score
CVSS Environmental Score: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVEID: CVE-2016-3427** *DESCRIPTION: An unspecified vulnerability related to the JMX component has complete confidentiality impact, complete integrity impact, and complete availability impact.
CVSS Base Score: 10
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112459 for the current score
CVSS Environmental Score: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

Affected Products and Versions

IBM SDK, Java Technology Edition, Version 7R1, provided by IBM WebSphere MQ 8.0.0.4 and earlier on Windows, Linux and AIX
IBM SDK, Java Technology Edition, Version 7, provided by IBM WebSphere MQ 8.0.0.4 and earlier on Solaris and HP-UX
IBM SDK, Java Technology Edition, Version 6, provided by IBM WebSphere MQ 7.5.0.6, IBM WebSphere MQ 7.1.0.7 and earlier on all platforms (except IBM i and z/OS)

Remediation/Fixes

IBM WebSphere MQ 8.0

Apply fix pack 8.0.0.5 when available, in the interim apply ifix IT14908

IBM WebSphere MQ 7.5

Apply fix pack 7.5.0.7 when available, in the interim apply ifix IT14908

IBM WebSphere MQ 7.1

Apply fix pack 7.1.0.8 when available, in the interim apply ifix IT14908

_For unsupported versions of IBM WebSphere MQ, _I__BM recommends upgrading to a fixed, supported version of the product.

Workarounds and Mitigations

None known