CVE-2024-35116: 
IBM WebSphere MQ vulnerability analysis and mitigation

IBM MQ versions 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD are vulnerable to a denial of service attack caused by an error applying configuration changes. The vulnerability was assigned CVE-2024-35116 and IBM X-Force ID: 290335 (IBM NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) by NIST with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, while IBM Corporation rated it at 5.9 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is associated with CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-789 (Memory Allocation with Excessive Size Value) (IBM NVD).

The vulnerability can lead to a denial of service attack when exploited, specifically affecting the server component of IBM MQ installations (IBM Advisory).

The vulnerability can be exploited through an error in applying configuration changes. The attack vector is network-accessible (AV:N) with high attack complexity (AC:H), requiring no privileges (PR:N) and no user interaction (UI:N) (IBM NVD).

IBM has released fixes under APAR IT45710. For IBM MQ version 9.0 LTS, apply Cumulative Security Update 9.0.0.26; for 9.1 LTS, apply Cumulative Security Update 9.1.0.22; for 9.2 LTS, apply Cumulative Security Update 9.2.0.26; for 9.3 LTS, apply Fix Pack 9.3.0.20; and for 9.3 CD, upgrade to IBM MQ version 9.4. No workarounds are available (IBM Advisory).