Security Bulletin: IBM WebSphere MQ keystore password traced by mqcertck on IBM i platform (CVE-2015-7462)

Summary The mqcertck tool which was newly added in MQ 8.0.0.4 could trace certificate keystore passwords. Vulnerability Details CVEID: CVE-2015-7462 DESCRIPTION: IBM WebSphere MQ could allow a local user with administrator privileges to decrypt other MQ administrators passwords by using the...

CVE-2015-7462

IBM WebSphere MQ 8.0.0.4 on IBM i platforms allows local users to discover cleartext certificate-keystore passwords within MQ trace output by leveraging administrator privileges to execute the mqcertck program...

CVE-2015-7462

IBM WebSphere MQ for IBM i 8.0.0.4 is affected. An administrator can run mqcertck from MQ trace output to reveal cleartext certificate-keystore passwords, exploiting local access to decrypt other MQ administrator passwords. The issue stems from the mqcertck tool introduced in MQ 8.0.0.4, enabling...