IBM MQ 9.2 < 9.2.0.46 LTS / 9.3 < 9.3.0.43 LTS / 9.4 < 9.4.0.30 LTS / 9.4 CD < 10.0.1.0 / 10.0 < 10.0.0.6 (7294654)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(376235);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/06");

  script_cve_id("CVE-2026-13271");

  script_name(english:"IBM MQ 9.2 < 9.2.0.46 LTS / 9.3 < 9.3.0.43 LTS / 9.4 < 9.4.0.30 LTS / 9.4 CD < 10.0.1.0 / 10.0 < 10.0.0.6 (7294654)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of IBM MQ Server running on the remote host is 9.2.0.0 prior to 9.2.0.46 LTS, or 9.3.0.0 prior to
9.3.0.43 LTS, or 9.4.0.0 prior to 9.4.0.30 LTS, or 9.4.0.0 through 9.4.5.1 CD, or 10.0.0.0 through 10.0.0.5.
It is, therefore, affected by a vulnerability as referenced in the 7294654 advisory.

  - IBM MQ Managed File Transfer could allow an authenticated attacker to obtain sensitive information or
    cause a denial of service due to improper restriction of XML external entity references in command queue
    processing. CWE: CWE-611: Improper Restriction of XML External Entity Reference (CVE-2026-13271)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  script_set_attribute(attribute:"see_also", value:"https://www.ibm.com/support/pages/node/7294654");
  script_set_attribute(attribute:"solution", value:
"Upgrade to IBM MQ 9.2.0.46 LTS, 9.3.0.43 LTS, 9.4.0.30 LTS, 10.0.0.6 LTS, 10.0.1.0 CD or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-13271");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:websphere_mq");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:mq");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ibm_mq_nix_installed.nbin", "websphere_mq_installed.nasl");
  script_require_keys("installed_sw/IBM WebSphere MQ");

  exit(0);
}

include('vcf.inc');

var app = 'IBM WebSphere MQ';

var app_info = vcf::get_app_info(app:app);

# The Windows detector (websphere_mq_installed.nasl) registers the install's components under
# 'Components' and lowercases them, while the Unix detector (ibm_mq_nix_installed.nbin) uses
# 'Installed Components' with the component map's own spelling - read either, case-folded.
var comps = tolower(app_info['Components']);
if (empty_or_null(comps))
  comps = tolower(app_info['Installed Components']);

if (app_info['Type'] != 'Server')
  audit(AUDIT_HOST_NOT, 'an affected product');

# The advisory scopes this to Managed File Transfer, an optional installable component, so an
# install without it is not affected.
if ('mft' >!< comps && 'managed file transfer' >!< comps)
  audit(AUDIT_INST_VER_NOT_VULN, app);

var constraints;
# The detectors derive Track with classify_mq_version() from includes/ibm_mq.inc, which
# classifies the registered version as 'LTS', 'CD', 'LTS/CD' (an initial release such as
# 9.4.0.0 or 10.0.0.0) or 'Unknown'. The 9.4 CD stream numerically overlaps the 9.4 LTS
# stream - the advisory lists 9.4.0.0 through 9.4.5.1 CD next to 9.4.0.0 through 9.4.0.26
# LTS - so the two tracks cannot share one constraint set.
# https://www.ibm.com/support/pages/ibm-mq-faq-long-term-support-and-continuous-delivery-releases
if (app_info['Track'] == 'CD')
{
  # 9.4 CD is fixed by 10.0.1.0. The 10.0 initial release is the base of both tracks, and
  # its CD fix is 10.0.1.0, so the 10.0 range is capped at the last affected level rather
  # than compared against a fixed version.
  constraints = [
    { 'min_version' : '9.4.0.0', 'max_version' : '9.4.5.1', 'fixed_display' : '10.0.1.0' },
    { 'min_version' : '10.0.0.0', 'max_version' : '10.0.0.5', 'fixed_display' : '10.0.1.0' }
  ];
}
else
{
  # 'LTS', 'LTS/CD' and 'Unknown'. An initial release is the base of both service streams,
  # so it takes the LTS fix here. The 9.2 and 9.4 LTS ranges are capped at the last
  # affected level because the advisory's fix packs skip intermediate levels (9.2.0.44
  # affected / 9.2.0.46 fixed, 9.4.0.26 affected / 9.4.0.30 fixed).
  constraints = [
    { 'min_version' : '9.2.0.0', 'max_version' : '9.2.0.44', 'fixed_display' : '9.2.0.46' },
    { 'min_version' : '9.3.0.0', 'fixed_version' : '9.3.0.43' },
    { 'min_version' : '9.4.0.0', 'max_version' : '9.4.0.26', 'fixed_display' : '9.4.0.30' },
    { 'min_version' : '10.0.0.0', 'max_version' : '10.0.0.5', 'fixed_display' : '10.0.0.6' }
  ];
}

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);