Sign-up

ID

VAR-201707-0666


CVE

CVE-2017-1285


TITLE

IBM WebSphere MQ Vulnerable to sending crafted messages

Trust: 0.8

sources: JVNDB: JVNDB-2017-005576

DESCRIPTION

IBM WebSphere MQ 9.0.1 and 9.0.2 could allow an authenticated user with authority to send a specially crafted message that would cause a channel to remain in a running state but not process messages. IBM X-Force ID: 125146. Multiple IBM Products are prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause denial-of-service condition

Trust: 1.89

sources: NVD: CVE-2017-1285 // JVNDB: JVNDB-2017-005576 // BID: 99538

AFFECTED PRODUCTS

vendor:ibmmodel:websphere mqscope:eqversion:9.0.2

Trust: 2.7

vendor:ibmmodel:websphere mqscope:eqversion:9.0.1

Trust: 2.7

vendor:ibmmodel:mq appliancescope:eqversion:9.0.2

Trust: 0.3

vendor:ibmmodel:mq appliancescope:eqversion:9.0.1

Trust: 0.3

vendor:ibmmodel:websphere mqscope:neversion:9.0.3

Trust: 0.3

vendor:ibmmodel:mq appliancescope:neversion:9.0.3

Trust: 0.3

sources: BID: 99538 // JVNDB: JVNDB-2017-005576 // CNNVD: CNNVD-201707-525 // NVD: CVE-2017-1285

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2017-1285
value: MEDIUM

Trust: 1.8

CNNVD: CNNVD-201707-525
value: MEDIUM

Trust: 0.6

NVD: CVE-2017-1285
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

NVD: CVE-2017-1285
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 1.8

sources: JVNDB: JVNDB-2017-005576 // CNNVD: CNNVD-201707-525 // NVD: CVE-2017-1285

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.8

sources: JVNDB: JVNDB-2017-005576 // NVD: CVE-2017-1285

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201707-525

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201707-525

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2017-1285

PATCH
title:2003856url:http://www-01.ibm.com/support/docview.wss?uid=swg22003856
Trust: 0.8
title:IBM MQ Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=71671
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2017-005576 // 
            
            
            
            CNNVD: CNNVD-201707-525

EXTERNAL IDS
db:NVDid:CVE-2017-1285
Trust: 2.7
db:BIDid:99538
Trust: 1.3
db:JVNDBid:JVNDB-2017-005576
Trust: 0.8
db:CNNVDid:CNNVD-201707-525
Trust: 0.6
sources:
            
            
            BID: 99538 // 
            
            
            
            JVNDB: JVNDB-2017-005576 // 
            
            
            
            CNNVD: CNNVD-201707-525 // 
            
            
            
            NVD: CVE-2017-1285

REFERENCES
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/125146
Trust: 1.6
url:https://www.ibm.com/support/docview.wss?uid=swg22003856
Trust: 1.6
url:http://www.securityfocus.com/bid/99538
Trust: 1.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-1285
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-1285
Trust: 0.8
url:http://www.ibm.com/
Trust: 0.3
url:http://www-306.ibm.com/software/integration/wmq/
Trust: 0.3
url:https://www-01.ibm.com/support/docview.wss?uid=swg22003856
Trust: 0.3
sources:
            
            
            BID: 99538 // 
            
            
            
            JVNDB: JVNDB-2017-005576 // 
            
            
            
            CNNVD: CNNVD-201707-525 // 
            
            
            
            NVD: CVE-2017-1285

CREDITS
IBM
Trust: 0.3
sources:
            
            
            BID: 99538

SOURCES
db:BIDid:99538
db:JVNDBid:JVNDB-2017-005576
db:CNNVDid:CNNVD-201707-525
db:NVDid:CVE-2017-1285

LAST UPDATE DATE
2022-05-04T09:51:28.671000+00:00

SOURCES UPDATE DATE
db:BIDid:99538date:2017-07-10T00:00:00
db:JVNDBid:JVNDB-2017-005576date:2017-08-01T00:00:00
db:CNNVDid:CNNVD-201707-525date:2017-07-13T00:00:00
db:NVDid:CVE-2017-1285date:2017-07-17T16:42:00

SOURCES RELEASE DATE
db:BIDid:99538date:2017-07-10T00:00:00
db:JVNDBid:JVNDB-2017-005576date:2017-08-01T00:00:00
db:CNNVDid:CNNVD-201707-525date:2017-07-13T00:00:00
db:NVDid:CVE-2017-1285date:2017-07-12T17:29:00