Security Bulletin: IBM MQ is vulnerable to a denial of service attack due to an error in the Channel processing function. (CVE-2019-4762)

Summary

An error was identified in the channel processing logic that means a remote attacker could execute a denial of service attack against a queue manager.

Vulnerability Details

CVEID:CVE-2019-4762
**DESCRIPTION:**IBM MQ is vulnerable to a denial of service attack due to an error in the Channel processing function.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/173625 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

IBM MQ 9.0 LTS

Apply Fix Pack 9.0.0.9

IBM MQ and IBM MQ Appliance 9.1 LTS

Apply Fix Pack 9.1.0.3

IBM MQ and IBM MQ Appliance 9.1 CD

Upgrade to IBM MQ 9.1.5

Workarounds and Mitigations

None