News
Vigil@nce - IBM WebSphere MQ: buffer overflow of mqm
July 2013 by Marc Jacob
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can generate a buffer overflow in mqm of IBM WebSphere
MQ, in order to trigger a denial of service, and possibly to
execute code.
Impacted products: WebSphere MQ
Severity: 2/4
Creation date: 02/07/2013
DESCRIPTION OF THE VULNERABILITY
IBM WebSphere MQ is a communication tool, for instance for
distributed applications.
The Unix version of the product includes a command named mqm that
runs setuid. However, some commands supported by this program
handles data chunks of variable length and the program does not
always correctly check that the chunk length is compatible with
the buffers size.
An attacker can therefore generate a buffer overflow in mqm of IBM
WebSphere MQ, in order to trigger a denial of service, and
possibly to execute code.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/IBM-WebSphere-MQ-buffer-overflow-of-mqm-13023
