Security Bulletin: IBM MQ Appliance is vulnerable to a buffer overflow (CVE-2024-25048)

Summary

IBM MQ Appliance has addressed a buffer overflow vulnerability, caused by improper bounds checking.

Vulnerability Details

CVEID:CVE-2024-25048
**DESCRIPTION:**IBM MQ is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote authenticated attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/283137 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

This vulnerability is addressed under APAR IT45110

IBM strongly recommends addressing the vulnerability now.

IBM MQ Appliance version 9.3 LTS

Apply IBM MQ Appliance 9.3.0.17 cumulative security update, or later firmware.

IBM MQ Appliance version 9.3 CD

Apply IBM MQ Appliance 9.3.5 Continuous Delivery release, or later firmware.

Workarounds and Mitigations

None