IBM7702B5511645349A9E843F592524C5EDC1865400EE5BA761C1203D5D24F816C6Security Bulletin: A vulnerability in Java runtime from IBM affects IBM WebSphere MQ and IBM MQ Appliance (CVE-2016-5597)
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
Summary
There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7 and 8 used by IBM WebSphere MQ and the IBM MQ Appliance. These issues were disclosed as part of the IBM Java SDK updates in October 2016.
Vulnerability Details
If you run your own Java code using the Java runtime from IBM delivered with this product, you should evaluate your code to determine whether the complete list of vulnerabilities are applicable to your code. For a complete list of vulnerabilities, refer to the IBM Java SDK Security Bulletin, located in the References section for more information.
CVEID: CVE-2016-5597
DESCRIPTION: An unspecified vulnerability related to the Networking component could allow a remote attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors.
CVSS Base Score: 5.9
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/118071> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected Products and Versions
IBM MQ 9.0.0.x Long Term Support (LTS)
Maintenance level 9.0.0.0 only
IBM MQ 9.0.x Continuous Delivery Release (CDR)
Continuous delivery update 9.0.1 only
IBM MQ Appliance 9.0.x
Update level 9.0.1 only
IBM MQ 8.0
Maintenance levels between 8.0.0.0 and 8.0.0.5
IBM MQ Appliance 8.0
Maintenance levels between 8.0.0.0 and 8.0.0.5
IBM WebSphere MQ 7.5
Maintenance levels between 7.5.0.0 and 7.5.0.7
IBM WebSphere MQ 7.1
Maintenance levels between 7.1.0.0 and 7.1.0.7
Remediation/Fixes
IBM MQ 9.0.0.x Long Term Support (LTS)
Apply fix pack 9.0.0.1.
IBM MQ V9.0.x CDR
Apply continuous delivery update 9.0.2 or later
IBM MQ Appliance V9.0.x
Apply update 9.0.2 or later
IBM MQ V8.0 & IBM MQ Appliance V8.0
Apply fix pack 8.0.0.6 or later maintenance
IBM WebSphere MQ 7.5
Apply fix pack 7.5.0.8
IBM WebSphere MQ 7.1
Apply iFix IT20034
Workarounds and Mitigations
None
| CPE | Name | Operator | Version |
|---|---|---|---|
| websphere mq | eq | 9.0.1 | |
| websphere mq | eq | 9.0 | |
| websphere mq | eq | 8.0 | |
| websphere mq | eq | 7.5 | |
| websphere mq | eq | 7.1 |
Related
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N