CVE-2015-0118

IBM WebSphere Message Broker Toolkit 7 before 7007 IF2 and 8 before 8005 IF1 and Integration Toolkit 9 before 9003 IF1 are distributed with MQ client JAR files that support only weak TLS ciphers, which might make it easier for remote attackers to obtain sensitive information by sniffing the network during a connection to an Integration Bus node.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg21957998	Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IT05725

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:websphere_message_broker:8.0.0.4:::::::*
	cpe:2.3:a:ibm:websphere_message_broker:8.0.0.5:::::::*
	cpe:2.3:a:ibm:websphere_message_broker:7.0.:::::::*
	cpe:2.3:a:ibm:websphere_message_broker:8.0.0.1:::::::*
	cpe:2.3:a:ibm:websphere_message_broker:8.0.0.3:::::::*
	cpe:2.3:a:ibm:websphere_message_broker:7.0.0.2:::::::*
	cpe:2.3:a:ibm:websphere_message_broker:7.0.0.3:::::::*
	cpe:2.3:a:ibm:websphere_message_broker:7.0.0.4:::::::*
	cpe:2.3:a:ibm:websphere_message_broker:7.0.0.5:::::::*
	cpe:2.3:a:ibm:websphere_message_broker:7.0.0.1:::::::*
	cpe:2.3:a:ibm:websphere_message_broker:8.0:::::::*
	cpe:2.3:a:ibm:websphere_message_broker:8.0.0.2:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:ibm:integration_bus:9.0:::::::*
	cpe:2.3:a:ibm:integration_bus:9.0.0.1:::::::*
	cpe:2.3:a:ibm:integration_bus:9.0.0.3:::::::*
	cpe:2.3:a:ibm:integration_bus:9.0.0.2:::::::*

Information

Published : 2015-06-28 15:59

Updated : 2015-06-29 09:27

NVD link : CVE-2015-0118

Mitre link : CVE-2015-0118

JSON object : View

CWE

CWE-310

Cryptographic Issues

Advertisement

Products Affected

ibm

integration_bus
websphere_message_broker

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21957998", "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21957998", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IT05725", "name": "IT05725", "tags": [], "refsource": "AIXAPAR"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "IBM WebSphere Message Broker Toolkit 7 before 7007 IF2 and 8 before 8005 IF1 and Integration Toolkit 9 before 9003 IF1 are distributed with MQ client JAR files that support only weak TLS ciphers, which might make it easier for remote attackers to obtain sensitive information by sniffing the network during a connection to an Integration Bus node."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-310"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2015-0118", "ASSIGNER": "psirt@us.ibm.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2015-06-28T22:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:8.0.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:8.0.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:7.0.:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:8.0.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:8.0.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:7.0.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:7.0.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:7.0.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:7.0.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:7.0.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:8.0.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:ibm:integration_bus:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:integration_bus:9.0.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:integration_bus:9.0.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:integration_bus:9.0.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2015-06-29T16:27Z"}