Security Bulletin: Invalid user group vulnerability in IBM MQ on Unix platform(CVE-2018-1551)

Summary

IBM MQ could allow users to have more authority than they should have if an MQ administrator creates an invalid user group name.

Vulnerability Details

CVEID: CVE-2018-1551 DESCRIPTION: IBM MQ could allow users to have more authority than they should have if an MQ administrator creates an invalid user group name.
CVSS Base Score: 3.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/142888&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

IBM MQ v8.0.0.2 to 8.0.0.8

IBM MQ 9.0.0.0 to 9.0.0.3

Remediation/Fixes

IBM MQ v8.0.0.2 to 8.0.0.8

Apply fix pack 8.0.0.9 or above

IBM MQ 9.0.0.0 to 9.0.0.3

Apply fix pack 9.0.0.4 or above

Workarounds and Mitigations

None