Security Bulletin: IBM UrbanCode Deploy Agents Don't Verify Server Identity (CVE-2016-0271)

Summary Mutual authentication in IBM UrbanCode Deploy ensures that unknown agents cannot connect to the server over JMS. However, if a trusted agent is compromised, it can impersonate the server and send work to other agents. Agents do not verify the identity of the server over either HTTP or JMS...

CVE-2016-0271

The agents in IBM UrbanCode Deploy 6.x before 6.0.1.14, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 do not verify a server's identity in a JMS session or an HTTP session, which allows local users to obtain root access to arbitrary agents via unspecified vectors...

CVE-2016-0271

IBM UrbanCode Deploy hardening advisory (CVE-2016-0271) affects agents that do not verify the server identity in JMS and HTTP sessions, enabling local privilege escalation to root on affected agents. Affected versions include IBM UrbanCode Deploy 6.x prior to 6.0.1.14, 6.1.x prior to 6.1.3.3, and...