IBM WebSphere MQ Multiple Unspecified Remote Memory Corruption Vulnerabilities

Bugtraq ID:	26441
Class:	Boundary Condition Error
CVE:	CVE-2007-6044
Remote:	Yes
Local:	No
Published:	Nov 14 2007 12:00AM
Updated:	Oct 02 2008 04:58PM
Credit:	Information Risk Management Plc. disclosed these vulnerabilities.
Vulnerable:	IBM WebSphere MQ 6.0.2 .2 IBM WebSphere MQ 5.3.1 IBM WebSphere MQ 5.3 .0.6 IBM WebSphere MQ 5.3 .0.5 IBM WebSphere MQ 5.3 .0.1 IBM WebSphere MQ 5.3 IBM WebSphere MQ 6
Not Vulnerable:	IBM WebSphere MQ 6.0.2 .3 IBM WebSphere MQ 5.3 Fix Pack 14

IBM WebSphere MQ Multiple Unspecified Remote Memory Corruption Vulnerabilities

IBM WebSphere MQ is affected by multiple unspecified remote memory-corruption vulnerabilities.

Successfully exploiting these issues allows remote attackers to crash affected services, denying service to legitimate users. Remote code execution may also be possible, but this has not been confirmed.

IBM WebSphere MQ 6.0 is vulnerable to these issues; other versions may also be affected.

IBM WebSphere MQ Multiple Unspecified Remote Memory Corruption Vulnerabilities

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM WebSphere MQ Multiple Unspecified Remote Memory Corruption Vulnerabilities

Solution:
A vendor update is available. Contact the vendor for details.

IBM WebSphere MQ Multiple Unspecified Remote Memory Corruption Vulnerabilities

References:

• IBM Vulnerabilities (IRM)
  
• WebSphere MQ Homepage (IBM)
  
• Six Remote Memory Corruption Vulnerabilities in IBM WebSphere MQ 6.0 ("IRM Research" )
  
• APAR IZ01272 - Potential security exposure in WebSphere® MQ client channels (IBM)