Security Bulletin: IBM MQ Appliance is vulnerable to heap-based buffer overflow (CVE-2022-48303)

Summary

IBM MQ Appliance has resolved a heap-based buffer overflow.

Vulnerability Details

CVEID:CVE-2022-48303
**DESCRIPTION:**GNU Tar is vulnerable to a heap-based buffer overflow, caused by an out-of-bounds read in the from_header() function in list.c when processing of V7 archive files. By persuading a victim to open a specially-crafted V7 file using whitespace characters in the mtime parameter, a remote attacker could overflow a buffer and execute arbitrary code in the context of the current process.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/245770 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

This vulnerability is addressed under IT43704

IBM strongly recommends addressing the vulnerability now.

IBM MQ Appliance version 9.3 LTS

Apply IBM MQ Appliance 9.3.0.6 fix pack, or later firmware.

IBM MQ Appliance version 9.3 CD

Apply IBM MQ Appliance 9.3.3 Continuous Delivery, or later firmware.

Workarounds and Mitigations

None