Security Bulletin
Summary
メッセージチャネルエージェント(MCA)がキューから大きなメッセージを取得してデータ変換をすると、バッファオーバーフローが起きてチャネルが異常終了する可能性があります。
最新の情報については下記の文書（英語）をご参照ください。
Security Bulletin: IBM WebSphere MQ Channel data conversion denial of service (CVE-2016-3013)
http://www.ibm.com/support/docview.wss?uid=swg21998661
Vulnerability Details
CVEID: CVE-2016-3013
DESCRIPTION: IBM WebSphere MQは、不適切なデータ変換処理のために、認証されたユーザーがMQのチャネルをクラッシュさせる可能性があります。
CVSS Base Score: 3.1
CVSS Temporal Score: 現在のスコアは https://exchange.xforce.ibmcloud.com/vulnerabilities/114276 を参照してください。
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
Affected Products and Versions
IBM WebSphere MQ 8.0.0.5もしくはそれ以下のFixpackレベル
Remediation/Fixes
Fixpack 6(8.0.0.6)以降を適用してください。
Workarounds and Mitigations
回避策はございません。
Get Notified about Future Security Bulletins
Important Note
IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.
References
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
15 June 2018
UID
swg21999833