Security Bulletin: IBM MQ Appliance is affected by a Kernel vulnerability (CVE-2020-25705)

Summary

IBM MQ Appliance has resolved a Kernel vulnerability.

Vulnerability Details

CVEID:CVE-2020-25705
**DESCRIPTION:**Linux Kernel could allow a remote attacker to bypass security restrictions, caused by a flaw in the way reply ICMP packets are limited. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass source port UDP randomization to scan open UDP ports.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/191785 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

Affected Products and Versions

Remediation/Fixes

This vulnerability is addressed under APAR IT42447

IBM strongly recommends addressing the vulnerability now.

IBM MQ Appliance version 9.2 LTS

Apply 9.2.0.7, or later firmware.

IBM MQ Appliance version 9.2 CD

Apply 9.2.5-CSU04, or later firmware.

Workarounds and Mitigations

None