CVE-2018-1419

IBM WebSphere MQ 8.0 and 9.0, when configured to use a PAM module for authentication, could allow a user to cause a deadlock in the IBM MQ PAM code which could result in a denial of service. IBM X-Force ID: 138949.

CVSS v3 5.3 MEDIUM
CVSS v2.0 3.5 LOW

5.3^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:N/A:P

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://www.ibm.com/support/docview.wss?uid=swg22014650	Vendor Advisory
http://www.securityfocus.com/bid/104488	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/138949	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:websphere_mq:8.0:::::::*
	cpe:2.3:a:ibm:websphere_mq:8.0.0.1:::::::*
	cpe:2.3:a:ibm:websphere_mq:8.0.0.2:::::::*
	cpe:2.3:a:ibm:websphere_mq:8.0.0.3:::::::*
	cpe:2.3:a:ibm:websphere_mq:8.0.0.4:::::::*
	cpe:2.3:a:ibm:websphere_mq:8.0.0.5:::::::*
	cpe:2.3:a:ibm:websphere_mq:8.0.0.6:::::::*
	cpe:2.3:a:ibm:websphere_mq:8.0.0.7:::::::*
	cpe:2.3:a:ibm:websphere_mq:8.0.0.8:::::::*
	cpe:2.3:a:ibm:websphere_mq:9.0:::::::*
	cpe:2.3:a:ibm:websphere_mq:9.0.0.1:::::::*
	cpe:2.3:a:ibm:websphere_mq:9.0.0.2:::::::*
	cpe:2.3:a:ibm:websphere_mq:9.0.1:::::::*
	cpe:2.3:a:ibm:websphere_mq:9.0.2:::::::*
	cpe:2.3:a:ibm:websphere_mq:9.0.3:::::::*
	cpe:2.3:a:ibm:websphere_mq:9.0.4:::::::*

History

No history.

Information

Published : 2018-06-15 14:29

Updated : 2024-02-28 16:25

NVD link : CVE-2018-1419

Mitre link : CVE-2018-1419

CVE.ORG link : CVE-2018-1419

JSON object : View

Products Affected

ibm

websphere_mq

CWE

NVD-CWE-noinfo

{"id": "CVE-2018-1419", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}, {"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "published": "2018-06-15T14:29:00.353", "references": [{"url": "http://www.ibm.com/support/docview.wss?uid=swg22014650", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securityfocus.com/bid/104488", "tags": ["Third Party Advisory", "VDB Entry"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/138949", "tags": ["Third Party Advisory", "VDB Entry"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "IBM WebSphere MQ 8.0 and 9.0, when configured to use a PAM module for authentication, could allow a user to cause a deadlock in the IBM MQ PAM code which could result in a denial of service. IBM X-Force ID: 138949."}, {"lang": "es", "value": "IBM WebSphere MQ 8.0 y 9.0, cuando se configura para emplear un m\u00f3dulo PAM para autenticaci\u00f3n, podr\u00eda permitir que un usuario provoque un deadlock en el c\u00f3digo IBM MQ PAM, lo que podr\u00eda resultar en una denegaci\u00f3n de servicio (DoS). IBM X-Force ID: 138949."}], "lastModified": "2019-10-09T23:38:25.523", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:websphere_mq:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "421E10D4-4B01-4D52-9FFB-208C4745063E"}, {"criteria": "cpe:2.3:a:ibm:websphere_mq:8.0.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5502347-56F2-400F-944B-A532A3A8DE0A"}, {"criteria": "cpe:2.3:a:ibm:websphere_mq:8.0.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E6FF889-5D7D-47C0-A2B2-F2BDB39BEFDB"}, {"criteria": "cpe:2.3:a:ibm:websphere_mq:8.0.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D800EA34-4826-4689-A3C0-03724290567B"}, {"criteria": "cpe:2.3:a:ibm:websphere_mq:8.0.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DCBDF404-693B-4500-80FA-90AE022BD5C4"}, {"criteria": "cpe:2.3:a:ibm:websphere_mq:8.0.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5FFC3793-4880-4103-B7F6-06F96A17357B"}, {"criteria": "cpe:2.3:a:ibm:websphere_mq:8.0.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3679D6F-1E3A-4546-A05B-5B4EA515B4C9"}, {"criteria": "cpe:2.3:a:ibm:websphere_mq:8.0.0.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4E6617F-85DF-49FE-B713-148624DC87A8"}, {"criteria": "cpe:2.3:a:ibm:websphere_mq:8.0.0.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03A2E32F-2019-4F5F-814D-60218B960A95"}, {"criteria": "cpe:2.3:a:ibm:websphere_mq:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63E773A8-4ED2-47AA-A2D7-5CD02CBA47C0"}, {"criteria": "cpe:2.3:a:ibm:websphere_mq:9.0.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4084EE93-8B41-493E-BB50-9ABC8E956C89"}, {"criteria": "cpe:2.3:a:ibm:websphere_mq:9.0.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA310DB1-904C-45D0-8CAC-0B01638A7D41"}, {"criteria": "cpe:2.3:a:ibm:websphere_mq:9.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0C2DE42-FE8C-4023-A495-A2DBFE2F97F9"}, {"criteria": "cpe:2.3:a:ibm:websphere_mq:9.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "406AADD2-9732-44F1-91FC-F8C90088AD5A"}, {"criteria": "cpe:2.3:a:ibm:websphere_mq:9.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "018595DD-9AAD-44C7-9A46-BC78AF1F6C2B"}, {"criteria": "cpe:2.3:a:ibm:websphere_mq:9.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF68ED28-0999-4622-A923-624284229F13"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}