IBM Security Bulletin: IBM MQ is vulnerable to a denial of service attack within the error logging function (CVE-2019-4039)

A vulnerability was found within the error logging function that meant that a local attacker could cause an overwrite of arbitrary MQ files and cause a denial of service attack against IBM MQ queue managers.

CVE(s): CVE-2019-4039

Affected product(s) and affected version(s):
IBM MQ V8 versions 8.0.0.0 – 8.0.0.11
IBM MQ V9 LTS versions 9.0.0.0 – 9.0.0.5
IBM MQ V9.1 LTS versions 9.1.0.0 – 9.1.0.1
IBM MQ V9.1 CD versions 9.1.0 – 9.1.1

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: https://www.ibm.com/support/docview.wss?uid=ibm10870492
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/156163

The post IBM Security Bulletin: IBM MQ is vulnerable to a denial of service attack within the error logging function (CVE-2019-4039) appeared first on IBM PSIRT Blog.

from IBM Product Security Incident Response Team https://ibm.co/2JWXVU4