IBM WebSphere Application Server for z/OS Double Free Denial of Service Vulnerability

Bugtraq ID:	15522
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 21 2005 12:00AM
Updated:	Nov 21 2005 12:00AM
Credit:	Reported by IBM.
Vulnerable:	IBM WebSphere Application Server for z/OS 5.0
Not Vulnerable:

IBM WebSphere Application Server for z/OS Double Free Denial of Service Vulnerability

IBM WebSphere Application Server for z/OS is prone to a double free vulnerability that may allow attackers to trigger a denial of service condition.

WebSphere Application Server for z/OS version 5.0 is vulnerable to this issue.

IBM WebSphere Application Server for z/OS Double Free Denial of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

IBM WebSphere Application Server for z/OS Double Free Denial of Service Vulnerability

Solution:
IBM has released a security advisory including APAR PK13936 to address this issue. Please see the referenced advisory for more information.


IBM WebSphere Application Server for z/OS 5.0

• IBM PK13936
  http://www-1.ibm.com/support/docview.wss?uid=swg1PK13936#more

IBM WebSphere Application Server for z/OS Double Free Denial of Service Vulnerability

References:

• PK13936: ABEND S0C4 CAUSED BY DOUBLE DELETE (IBM)
  
• WebSphere Product Page (IBM)