cnvd - cnvd-2015-04111

cnvd-2015-04111

Vulnerability from cnvd

Title: IBM WebSphere Message Broker Toolkit和IBM Integration Toolkit信息泄露漏洞

Description:

IBM WebSphere Message Broker Toolkit和Integration Toolkit都是是美国IBM公司的产品。前者是一个企业服务总线（ESB）产品展示的图形界面。后者是一个基于Eclipse平台的集成开发环境和图形用户界面。

IBM WebSphere Message Broker Toolkit和IBM Integration Toolkit中存在安全漏洞，该漏洞源于MQ客户端的JAR文件使用弱的TLS密码。远程攻击者可通过在连接Integration Bus节点期间嗅探网络利用该漏洞获取敏感信息。

Severity: 低

Patch Name: IBM WebSphere Message Broker Toolkit和IBM Integration Toolkit信息泄露漏洞的补丁

Patch Description:

IBM WebSphere Message Broker Toolkit和Integration Toolkit都是是美国IBM公司的产品。前者是一个企业服务总线（ESB）产品展示的图形界面。后者是一个基于Eclipse平台的集成开发环境和图形用户界面。IBM WebSphere Message Broker Toolkit和IBM Integration Toolkit中存在安全漏洞，该漏洞源于MQ客户端的JAR文件使用弱的TLS密码。远程攻击者可通过在连接Integration Bus节点期间嗅探网络利用该漏洞获取敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： http://www-01.ibm.com/support/docview.wss?uid=swg21957998

Reference: http://www-01.ibm.com/support/docview.wss?uid=swg21957998

Impacted products

Name
['IBM WebSphere Message Broker Toolkit 7(<7007 IF2)', 'IBM WebSphere Message Broker Toolkit 8(<8005 IF1)', 'IBM Integration Toolkit 9(<9003 IF1)']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-0118"
    }
  },
  "description": "IBM WebSphere Message Broker Toolkit\u548cIntegration Toolkit\u90fd\u662f\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4ea7\u54c1\u3002\u524d\u8005\u662f\u4e00\u4e2a\u4f01\u4e1a\u670d\u52a1\u603b\u7ebf\uff08ESB\uff09\u4ea7\u54c1\u5c55\u793a\u7684\u56fe\u5f62\u754c\u9762\u3002\u540e\u8005\u662f\u4e00\u4e2a\u57fa\u4e8eEclipse\u5e73\u53f0\u7684\u96c6\u6210\u5f00\u53d1\u73af\u5883\u548c\u56fe\u5f62\u7528\u6237\u754c\u9762\u3002\r\n\r\nIBM WebSphere Message Broker Toolkit\u548cIBM Integration Toolkit\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eMQ\u5ba2\u6237\u7aef\u7684JAR\u6587\u4ef6\u4f7f\u7528\u5f31\u7684TLS\u5bc6\u7801\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5728\u8fde\u63a5Integration Bus\u8282\u70b9\u671f\u95f4\u55c5\u63a2\u7f51\u7edc\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "discovererName": "IBM",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://www-01.ibm.com/support/docview.wss?uid=swg21957998",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-04111",
  "openTime": "2015-06-30",
  "patchDescription": "IBM WebSphere Message Broker Toolkit\u548cIntegration Toolkit\u90fd\u662f\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4ea7\u54c1\u3002\u524d\u8005\u662f\u4e00\u4e2a\u4f01\u4e1a\u670d\u52a1\u603b\u7ebf\uff08ESB\uff09\u4ea7\u54c1\u5c55\u793a\u7684\u56fe\u5f62\u754c\u9762\u3002\u540e\u8005\u662f\u4e00\u4e2a\u57fa\u4e8eEclipse\u5e73\u53f0\u7684\u96c6\u6210\u5f00\u53d1\u73af\u5883\u548c\u56fe\u5f62\u7528\u6237\u754c\u9762\u3002IBM WebSphere Message Broker Toolkit\u548cIBM Integration Toolkit\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eMQ\u5ba2\u6237\u7aef\u7684JAR\u6587\u4ef6\u4f7f\u7528\u5f31\u7684TLS\u5bc6\u7801\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5728\u8fde\u63a5Integration Bus\u8282\u70b9\u671f\u95f4\u55c5\u63a2\u7f51\u7edc\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM WebSphere Message Broker Toolkit\u548cIBM Integration Toolkit\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM WebSphere Message Broker Toolkit 7(\u003c7007 IF2)",
      "IBM WebSphere Message Broker Toolkit 8(\u003c8005 IF1)",
      "IBM Integration Toolkit 9(\u003c9003 IF1)"
    ]
  },
  "referenceLink": "http://www-01.ibm.com/support/docview.wss?uid=swg21957998",
  "serverity": "\u4f4e",
  "submitTime": "2015-06-29",
  "title": "IBM WebSphere Message Broker Toolkit\u548cIBM Integration Toolkit\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2015-0118 (GCVE-0-2015-0118)

Vulnerability from cvelistv5

Published

2015-06-28 22:00

Modified

2024-08-06 03:55

Severity ?

CWE

Summary

IBM WebSphere Message Broker Toolkit 7 before 7007 IF2 and 8 before 8005 IF1 and Integration Toolkit 9 before 9003 IF1 are distributed with MQ client JAR files that support only weak TLS ciphers, which might make it easier for remote attackers to obtain sensitive information by sniffing the network during a connection to an Integration Bus node.

References

▼	URL	Tags
	http://www-01.ibm.com/support/docview.wss?uid=swg21957998	x_refsource_CONFIRM
	http://www-01.ibm.com/support/docview.wss?uid=swg1IT05725	vendor-advisory, x_refsource_AIXAPAR

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T03:55:28.166Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21957998"
          },
          {
            "name": "IT05725",
            "tags": [
              "vendor-advisory",
              "x_refsource_AIXAPAR",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IT05725"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-06-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM WebSphere Message Broker Toolkit 7 before 7007 IF2 and 8 before 8005 IF1 and Integration Toolkit 9 before 9003 IF1 are distributed with MQ client JAR files that support only weak TLS ciphers, which might make it easier for remote attackers to obtain sensitive information by sniffing the network during a connection to an Integration Bus node."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-06-28T22:57:01",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21957998"
        },
        {
          "name": "IT05725",
          "tags": [
            "vendor-advisory",
            "x_refsource_AIXAPAR"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IT05725"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2015-0118",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM WebSphere Message Broker Toolkit 7 before 7007 IF2 and 8 before 8005 IF1 and Integration Toolkit 9 before 9003 IF1 are distributed with MQ client JAR files that support only weak TLS ciphers, which might make it easier for remote attackers to obtain sensitive information by sniffing the network during a connection to an Integration Bus node."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21957998",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21957998"
            },
            {
              "name": "IT05725",
              "refsource": "AIXAPAR",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IT05725"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2015-0118",
    "datePublished": "2015-06-28T22:00:00",
    "dateReserved": "2014-11-18T00:00:00",
    "dateUpdated": "2024-08-06T03:55:28.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted