====================================================================

                             CERT-Renater

                  Note d'Information No. 2012/VULN382
____________________________________________________________________

DATE                : 26/09/2012

HARDWARE PLATFORM(S): /


OPERATING SYSTEM(S) : Solaris running IBM WebSphere MQ versions 7.0.1,
                                      7.1, 7.5.

======================================================================
http://www-01.ibm.com/support/docview.wss?uid=swg21610285
______________________________________________________________________

WebSphere MQ Security Vulnerability: potential denial of service attack
on multiplexed server connection channels

Flash (Alert)

Document information

WebSphere MQ

Security

Software version:
7.0.1, 7.1, 7.5

Operating system(s):
Solaris

Software edition:
All Editions

Reference #:
1610285

Modified date:
2012-09-20

Abstract

WebSphere MQ Security Vulnerability: There is the potential for a
client application to cause an invalid address alignment exception in
the server message channel agent on a Solaris queue manager to perform
a denial of service attack.


Content

VULNERABILITY DETAILS

CVE ID: CVE-2012-2199

DESCRIPTION:
There is the potential for a client application to cause an
invalid address alignment exception in the server message channel agent
on a Solaris queue manager to perform a denial of service attack.

CVSS:
CVSS Base Score: 5
CVSS Temporal Score: See
http://xforce.iss.net/xforce/xfdb/76434 for the current score CVSS
Environmental Score*: Undefined CVSS Vector:
(AV:N/AC:L/Au:N/C:N/I:N/A:P) *The CVSS Environment Score is customer
environment specific
and will ultimately impact the Overall CVSS Score. Customers can
evaluate the impact of this vulnerability in their environments by
accessing the links in the Reference section of this Flash.

AFFECTED PLATFORMS:

    WebSphere MQ 7.0.1 server on Solaris (SPARC & x86-64) WebSphere MQ
7.1 server on Solaris (SPARC & x86-64) WebSphere MQ 7.5 server on
Solaris (SPARC & x86-64)

REMEDIATION:
The recommended solution is to apply the fix for each named
product as soon as practical. Please see below for information on
the fixes available.

FIX
For WebSphere MQ 7.0.1 on Solaris platforms, apply fix pack 7.0.1.9. For
WebSphere MQ 7.1 on Solaris platforms, apply APAR IC82725 For WebSphere
MQ 7.5 on Solaris platforms, apply APAR IC82725

WORKAROUND:
None known; apply fixes.

Mitigation None known

REFERENCES:
Complete CVSS Guide (http://www.first.org/cvss/cvss-guide.html)
On-line Calculator V2
(http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2)
X-Force Vulnerability Database (http://xforce.iss.net/xforce/xfdb/76434)
CVE-2012-2199 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2199)

CHANGE HISTORY:
20th September 2012: Original Copy Published

Note: According to the Forum of Incident Response and Security Teams
(FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry
open standard designed to convey vulnerability severity and help to
determine urgency and priority of response." IBM PROVIDES THE CVSS
SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR
POTENTIAL SECURITY VULNERABILITY.

Related information

X-Force Vulnerability CVE-2012-2199

Product Alias/Synonym

WMQ MQ Copyright and trademark information

IBM, the IBM logo and ibm.com are trademarks of International Business
Machines Corp., registered in many jurisdictions worldwide. Other
product and service names might be trademarks of IBM or other
companies. A current list of IBM trademarks is available on the Web at
"Copyright and trademark information" at
www.ibm.com/legal/copytrade.shtml.

======================================================================

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================