CVE-2016-5879 — HIGH (8.8) — White Hats Nepal

Vulnerability Description

MQCLI on IBM MQ Appliance M2000 and M2001 devices allows local users to execute arbitrary shell commands via a crafted (1) Disaster Recovery or (2) High Availability command.

CVSS Score

8.8

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Ibm	Mq Appliance Firmware	8.0
Ibm	Mq Appliance M2000	-
Ibm	Mq Appliance M2001	-

Related Weaknesses (CWE)

CWE-20

References

http://www-01.ibm.com/support/docview.wss?uid=swg1IT16174Not Applicable
http://www-01.ibm.com/support/docview.wss?uid=swg21987697Vendor Advisory
http://www.securityfocus.com/bid/92538
http://www-01.ibm.com/support/docview.wss?uid=swg1IT16174Not Applicable
http://www-01.ibm.com/support/docview.wss?uid=swg21987697Vendor Advisory
http://www.securityfocus.com/bid/92538

FAQ

What is CVE-2016-5879?

CVE-2016-5879 is a vulnerability with a CVSS score of 8.8 (HIGH). MQCLI on IBM MQ Appliance M2000 and M2001 devices allows local users to execute arbitrary shell commands via a crafted (1) Disaster Recovery or (2) High Availability command.

How severe is CVE-2016-5879?

CVE-2016-5879 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2016-5879?

Check the references section above for vendor advisories and patch information. Affected products include: Ibm Mq Appliance Firmware, Ibm Mq Appliance M2000, Ibm Mq Appliance M2001.