CVE-2024-25016: 
IBM WebSphere MQ vulnerability analysis and mitigation

IBM MQ and IBM MQ Appliance versions 9.0, 9.1, 9.2, 9.3 LTS, and 9.3 CD contain a vulnerability that could allow a remote unauthenticated attacker to cause a denial of service due to incorrect buffering logic. This vulnerability was assigned CVE-2024-25016 and IBM X-Force ID 281279, with a CVSS v3.1 base score of 7.5 (HIGH) (IBM Security Bulletin).

The vulnerability stems from incorrect buffering logic in IBM MQ and IBM MQ Appliance. It has been assigned a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network accessibility, low attack complexity, no privileges required, no user interaction needed, and high impact on availability. The vulnerability is classified under CWE-20 (Improper Input Validation) (NVD).

The vulnerability affects the availability of the system, potentially allowing attackers to cause a denial of service. The high availability impact (A:H) in the CVSS score indicates that there is a total shutdown of the affected resource, while confidentiality (C:N) and integrity (I:N) are not impacted (IBM Security Bulletin).

The vulnerability can be exploited by a remote unauthenticated attacker, requiring low attack complexity and no user interaction. The network attack vector (AV:N) indicates that the vulnerable component is bound to the network stack and the attacker's path is through OSI layer 3 (NVD).

IBM has addressed this vulnerability under APAR IT45026. The following fixes are available: Cumulative Security Update 9.0.0.23 for version 9.0 LTS, Fix Pack 9.1.0.20 for version 9.1 LTS, Cumulative Security Update 9.2.0.22 for version 9.2 LTS, Cumulative Security Update 9.3.0.16 for version 9.3 LTS, and upgrade to version 9.3.5 CD for 9.3 CD users. No workarounds are available (IBM Security Bulletin).