IBM Support

Security Bulletin: IBM MQ and IBM WebSphere MQ are affected by Side channel attacks on modular exponentiation (CVE-2016-0702)

Created by Robert Parker on

Security Bulletin


Summary

IBM MQ and WebSphere MQ have addressed CVE-2016-0702

The GSKit cryptographic libraries supplied with MQ are impacted by the same issue described in the OpenSSL disclosure.

Vulnerability Details

CVEID: CVE-2016-0702
DESCRIPTION: OpenSSL could allow a local attacker to obtain sensitive information, caused by a side-channel attack against a system based on the Intel Sandy-Bridge microarchitecture. An attacker could exploit this vulnerability to recover RSA keys.
CVSS Base Score: 2.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111144 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

WebSphere MQ v7.0.1

  • Maintenance levels 7.0.1.0 - 7.0.1.14

WebSphere MQ v7.1
  • Maintenance levels 7.1.0.0 - 7.1.0.9

WebSphere MQ v7.5
  • Maintenance levels 7.5.0.0 - 7.5.0.8

IBM MQ v8
  • Maintenance levels 8.0.0.0 - 8.0.0.8

IBM MQ v9 LTS
  • Maintenance levels 9.0.0.0 - 9.0.0.2

IBM MQ v9 CD
  • Maintenance levels 9.0.0 - 9.0.4

Remediation/Fixes

WebSphere MQ v7.0.1

  • Raise a support ticket with WebSphere MQ support requesting a fix for APAR IT25200

WebSphere MQ v7.1
  • Raise a support ticket with WebSphere MQ support requesting a fix for APAR IT25200

WebSphere MQ v7.5
IBM MQ v8
IBM MQ v9 LTS
IBM MQ v9 CD

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Complete CVSS v3 Guide
On-line Calculator v3

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

21 June 2017: Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SSYHRD","label":"IBM MQ"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"SSL","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF012","label":"IBM i"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"9.0.4;9.0.3;9.0.2;9.0.1;9.0.0.2;9.0.0.1;9.0;8.0.0.8;8.0.0.7;8.0.0.6;8.0.0.5;8.0.0.4;8.0.0.3;8.0.0.2;8.0.0.1;8.0;7.5.0.8;7.5.0.7;7.5.0.6;7.5.0.5;7.5.0.4;7.5.0.3;7.5.0.2;7.5.0.1;7.5;7.1.0.7;7.1.0.6;7.1.0.5;7.1.0.4;7.1.0.3;7.1.0.2;7.1.0.1;7.1;7.0.1.9;7.0.1.8;7.0.1.7;7.0.1.6;7.0.1.5;7.0.1.4;7.0.1.3;7.0.1.2;7.0.1.14;7.0.1.13;7.0.1.12;7.0.1.11;7.0.1.10;7.0.1.1;7.0.1","Edition":"All Editions","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SSYHRD","label":"IBM MQ"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":" ","Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SSFKSJ","label":"WebSphere MQ"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":" ","Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
19 August 2022

UID

swg22013020

Page Feedback