Details of VAR-201707-0551

ID

VAR-201707-0551

CVE

CVE-2017-1318

TITLE

IBM MQ An arbitrary command execution vulnerability in the appliance

Trust: 0.8

sources: JVNDB: JVNDB-2017-006094

DESCRIPTION

IBM MQ Appliance 8.0 and 9.0 could allow an authenticated messaging administrator to execute arbitrary commands on the system, caused by command execution. IBM X-Force ID: 125730. Vendors have confirmed this vulnerability IBM X-Force ID: 125730 It is released as.Arbitrary commands could be executed by an authorized message administrator. An attacker can exploit this issue to execute arbitrary command on the affected system. This may aid in further attacks. MQ Appliance 9.0.1, 9.0.2, and 8.0.0.0 through 8.0.0.6 are vulnerable

Trust: 1.89

sources: NVD: CVE-2017-1318 // JVNDB: JVNDB-2017-006094 // BID: 99594

AFFECTED PRODUCTS

vendor:	ibm	model:	mq appliance	scope:	eq	version:	9.0.1	Trust: 1.9
vendor:	ibm	model:	mq appliance	scope:	eq	version:	8.0.0.6	Trust: 1.9
vendor:	ibm	model:	mq appliance	scope:	eq	version:	8.0.0.5	Trust: 1.9
vendor:	ibm	model:	mq appliance	scope:	eq	version:	8.0.0.4	Trust: 1.9
vendor:	ibm	model:	mq appliance	scope:	eq	version:	8.0.0.3	Trust: 1.9
vendor:	ibm	model:	mq appliance	scope:	eq	version:	8.0.0.2	Trust: 1.9
vendor:	ibm	model:	mq appliance	scope:	eq	version:	8.0.0.1	Trust: 1.9
vendor:	ibm	model:	mq appliance	scope:	eq	version:	8.0.0.0	Trust: 1.9
vendor:	ibm	model:	mq appliance	scope:	eq	version:	9.0.2	Trust: 1.6
vendor:	ibm	model:	mq appliance	scope:	eq	version:	9.0	Trust: 1.1
vendor:	ibm	model:	mq appliance	scope:	eq	version:	8.0	Trust: 0.8
vendor:	ibm	model:	mq appliance	scope:	ne	version:	9.0.3	Trust: 0.3
vendor:	ibm	model:	mq appliance	scope:	ne	version:	8.0.0.7	Trust: 0.3

sources: BID: 99594 // JVNDB: JVNDB-2017-006094 // CNNVD: CNNVD-201707-753 // NVD: CVE-2017-1318

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2017-1318
value:	HIGH
Trust: 1.8
CNNVD:	CNNVD-201707-753
value:	CRITICAL
Trust: 0.6

NVD:	CVE-2017-1318
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

NVD:	CVE-2017-1318
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 1.8

sources: JVNDB: JVNDB-2017-006094 // CNNVD: CNNVD-201707-753 // NVD: CVE-2017-1318

PROBLEMTYPE DATA

problemtype:

CWE-78

Trust: 1.8

sources: JVNDB: JVNDB-2017-006094 // NVD: CVE-2017-1318

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201707-753

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201707-753

CONFIGURATIONS

sources: NVD: CVE-2017-1318

PATCH

title:	2003815	url:	http://www-01.ibm.com/support/docview.wss?uid=swg22003815	Trust: 0.8
title:	IBM MQ Appliance Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=71800	Trust: 0.6

sources: JVNDB: JVNDB-2017-006094 // CNNVD: CNNVD-201707-753

EXTERNAL IDS

db:	NVD	id:	CVE-2017-1318	Trust: 2.7
db:	BID	id:	99594	Trust: 1.3
db:	JVNDB	id:	JVNDB-2017-006094	Trust: 0.8
db:	CNNVD	id:	CNNVD-201707-753	Trust: 0.6

sources: BID: 99594 // JVNDB: JVNDB-2017-006094 // CNNVD: CNNVD-201707-753 // NVD: CVE-2017-1318

REFERENCES

url:	http://www.ibm.com/support/docview.wss?uid=swg22003815	Trust: 1.6
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/125730	Trust: 1.6
url:	http://www.securityfocus.com/bid/99594	Trust: 1.0
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-1318	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-1318	Trust: 0.8
url:	http://www.ibm.com	Trust: 0.3
url:	http://www-01.ibm.com/support/docview.wss?uid=swg22003815	Trust: 0.3

sources: BID: 99594 // JVNDB: JVNDB-2017-006094 // CNNVD: CNNVD-201707-753 // NVD: CVE-2017-1318

CREDITS

IBM.

Trust: 0.3

sources: BID: 99594

SOURCES

db:	BID	id:	99594
db:	JVNDB	id:	JVNDB-2017-006094
db:	CNNVD	id:	CNNVD-201707-753
db:	NVD	id:	CVE-2017-1318

LAST UPDATE DATE

2022-05-04T10:26:49.161000+00:00

SOURCES UPDATE DATE

db:	BID	id:	99594	date:	2017-07-14T00:00:00
db:	JVNDB	id:	JVNDB-2017-006094	date:	2017-08-18T00:00:00
db:	CNNVD	id:	CNNVD-201707-753	date:	2017-07-19T00:00:00
db:	NVD	id:	CVE-2017-1318	date:	2017-07-28T18:00:00

SOURCES RELEASE DATE

db:	BID	id:	99594	date:	2017-07-14T00:00:00
db:	JVNDB	id:	JVNDB-2017-006094	date:	2017-08-18T00:00:00
db:	CNNVD	id:	CNNVD-201707-753	date:	2017-07-19T00:00:00
db:	NVD	id:	CVE-2017-1318	date:	2017-07-18T13:29:00