IBM Support

【セキュリティ情報】: WebSphere Message Broker と IBM Integration Bus 情報漏えいの脆弱性(CVE-2017-1126)

Created by Masatsugu Sasai on
Published URL:
https://www.ibm.com/support/pages/node/297787
297787

Security Bulletin


Summary

IBM Integration Bus と WebSphere Message Broker に権限のないユーザーがソフトウェアバージョンなどの情報を得てしまう情報漏えいのセキュリティ脆弱性が見つかりました。

Vulnerability Details

最新の情報については、下記URLの文書（英語）をご参照ください。
WebSphere Message Broker and IBM Integration Bus are affected by information disclosure　vulnerability(CVE-2017-1126)
http://www-01.ibm.com/support/docview.wss?uid=swg22008470

CVEID: CVE-2017-1126
DESCRIPTION:IBM Integration Bus と WebSphere Message Broker に権限のないユーザーがソフトウェアバージョンなどの更なる攻撃を引き起こしてしまう危険性のある情報を得ることができてしまうという情報漏えいのセキュリティ脆弱性が見つかりました。

CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/121341 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

下記のバージョンにおいて影響を受けます。

IBM Integration Bus V9.0.0.0 - V9.0.0.8 and V10.0.0.0 - V10.0.0.9

WebSphere Message Broker V8.0.0.0 - V8.0.0.8

Remediation/Fixes

Product

VRMFAPARRemediation/Fix
IBM Integration BusV10.0.0.0-V10.0.0.9IT18731/
IT21161		対象のAPARは fix pack 10.0.0.10に含まれます。

http://www-01.ibm.com/support/docview.wss?uid=swg24043943
IBM Integration BusV9.0.0.0-V9.0.0.8IT18731/
IT21161 		対象のAPARは fix pack 9.0.0.9に含まれます。
http://www-01.ibm.com/support/docview.wss?uid=swg24043947
WebSphere Message BrokerV8.0.0.0 -V8.0.0.8IT18731/
IT21161		対象のAPARは fix pack 8.0.0.9 に含まれます。http://www-01.ibm.com/support/docview.wss?uid=swg24043806

For a fix for APAR IT21161, please contact IBM support.


Websphere Message Broker V8 は既にサポート期間が終了しております。IBMはサポートされるバージョンへアップグレードすることを推奨致します。もしお客様に延長サポート契約があり、かつ使用しているバージョｎがv8.0.0.9である場合は、必要なiFixを入手するためにIBMサポートへお問い合わせいただけますでしょうか。

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Complete CVSS v3 Guide
On-line Calculator v3

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

IBM Secure Engineering Web Portal
https://www.ibm.com/security/secure-engineering/bulletins.html

IBM Product Security Incident Response Blog
https://www.ibm.com/blogs/psirt/

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SSNQK6","label":"IBM Integration Bus"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"--","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"10.0;9.0","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SSKM8N","label":"WebSphere Message Broker"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":" ","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"8.0","Edition":"","Line of Business":{"code":"LOB36","label":"IBM Automation"}}]

Document Information

Modified date:
23 March 2020

UID

swg22009319

Page Feedback