Patch Ticker

IBM MQ message server flaws (service stop, data exposure, code execution)

A company message server can be broken into by any logged-in person.

Summary

IBM MQ server has several flaws fixed together. A logged-in user can stop the service, read sensitive information, or in some cases run code; versions 9.2, 9.3, 9.4 and 10.0 are affected.

Affected when

  • attacker with an authenticated MQ account
  • Managed File Transfer in use (some flaws)

What to do

Update to the fixed version for your line: 9.2 LTS 9.2.0.46, 9.3 LTS 9.3.0.43, 9.4 LTS 9.4.0.30, 10.0 LTS 10.0.0.6, 9.4 CD and 10.0 CD 10.0.1.0. No workaround is given.

Update to at least the version for your product:

  • IBM MQ 9.2 LTS 9.2.0.46 or later
  • IBM MQ 9.3 LTS 9.3.0.43 or later
  • IBM MQ 9.4 LTS 9.4.0.30 or later
  • IBM MQ 10.0 LTS 10.0.0.6 or later
  • IBM MQ 9.4 CD and 10.0 CD 10.0.1.0 or later

Products and platforms

  • Windows
  • Linux
  • IBM MQ

CVE IDs

Sources

Times

First published

First seen