Security Bulletin: A vulnerability in the GSKit component of IBM WebSphere MQ (CVE-2016-0201)

Summary

A vulnerability has been addressed in the GSKit component of IBM WebSphere MQ.

Vulnerability Details

CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit this vulnerability to obtain authentication credentials.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/109310 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

IBM WebSphere MQ 8.0

Fix Pack 8.0.0.4 and previous maintenance levels

IBM WebSphere MQ 7.5

Fix Pack 7.5.0.5 and previous maintenance levels

IBM WebSphere MQ 7.1

Fix Pack 7.1.0.7 and previous maintenance levels

IBM WebSphere MQ 7.0

Fix Pack 7.0.1.13 and previous maintenance levels

Remediation/Fixes

IBM WebSphere MQ 8.0

Apply the ifix for APAR IT13023

IBM WebSphere MQ 7.5

Apply the ifix for APAR IV77604

IBM WebSphere MQ 7.1

Apply the ifix for APAR IV77604

IBM WebSphere MQ 7.0.1

Apply the ifix for APAR IV77604

Workarounds and Mitigations

None