IBM WebSphere MQ Security Vulnerability: potential denial of service attack with large messages

VULNERABILITY DETAILS

CVE ID: CVE-2012-4863

DESCRIPTION:
There is the potential for an application to put a sequence of large (> 1Mb) messages to a queue and indirectly cause a buffer overwrite in a queue manager agent. In some circumstances this type of overwrite could cause the queue manager to abend, thereby causing a denial of service.

The vulnerability relies on a second application using 'asynchronous consume' to retrieve the large messages in order, either directly in the application (for example using the MQCB and MQCTL verbs) or indirectly by using 'queue read ahead' in a client application.

CVSS:
CVSS Base Score: 4
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/79920 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P)
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Flash.

AFFECTED PLATFORMS:

• IBM WebSphere MQ 7.1 server on all distributed platforms
• IBM WebSphere MQ 7.5 server on all distributed platforms

REMEDIATION:
The recommended solution is to apply the fix for each named product as soon as practical. Please see below for information on the fixes available.

FIX
IBM WebSphere MQ 7.1
Apply fix pack 7.1.0.2.

IBM WebSphere MQ 7.5
Apply fix pack 7.5.0.1 when available. In the interim apply APAR IC82908.

WORKAROUND:
None known; apply fixes.

MITIGATION:
None known.

REFERENCES:
Complete CVSS Guide ( http://www.first.org/cvss/cvss-guide.html)
On-line Calculator V2 ( http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2)
X-Force Vulnerability Database ( http://xforce.iss.net/xforce/xfdb/79920)
CVE-2012-4863 ( http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4863)

ACKNOWLEDGEMENT:
The vulnerability was reported to IBM by Secunia ApS.

CHANGE HISTORY:
26th November 2012: Original Copy Published.

Note:  According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.