CVE-2008-1592

MQSeries 5.1 in IBM WebSphere MQ 5.1 through 5.3.1 on the HP NonStop and Tandem NSK platforms does not require mqm group membership for execution of administrative tasks, which allows local users to bypass intended access restrictions via the runmqsc program, related to "Pathway panels."

CVSS v2.0 4.6 MEDIUM

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/29360
http://securitytracker.com/id?1019610
http://www-1.ibm.com/support/docview.wss?uid=swg21297035	Patch
http://www.securityfocus.com/bid/28235
http://www.vupen.com/english/advisories/2008/0869

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:hp:nonstop::::::::
	cpe:2.3:o:tandem_computers:tandem_operating_system:nsk:::::::*

OR	cpe:2.3:a:ibm:websphere_mq:5.1:::::::*
	cpe:2.3:a:ibm:websphere_mq:5.3:::::::*
	cpe:2.3:a:ibm:websphere_mq:5.3.1:::::::*

History

No history.

Information

Published : 2008-03-31 23:44

Updated : 2011-03-08 03:07

NVD link : CVE-2008-1592

Mitre link : CVE-2008-1592

CVE.ORG link : CVE-2008-1592

JSON object : View

Products Affected

tandem_computers

tandem_operating_system

hp

nonstop

ibm

websphere_mq

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2008-1592", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2008-03-31T23:44:00.000", "references": [{"url": "http://secunia.com/advisories/29360", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1019610", "source": "cve@mitre.org"}, {"url": "http://www-1.ibm.com/support/docview.wss?uid=swg21297035", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/28235", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2008/0869", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "MQSeries 5.1 in IBM WebSphere MQ 5.1 through 5.3.1 on the HP NonStop and Tandem NSK platforms does not require mqm group membership for execution of administrative tasks, which allows local users to bypass intended access restrictions via the runmqsc program, related to \"Pathway panels.\""}, {"lang": "es", "value": "MQSeries 5.1 en IBM WebSphere MQ de 5.1 a 5.3.1 en las plataformas HP NonStop y Tandem NSK no requiere que se sea del grupo mqm para la ejecuci\u00f3n de tareas administrativas, lo que permite a usuarios locales evitar las restricciones de acceso pervistas a trav\u00e9s del programa runmqsc, relacionado con \"paneles Pathway\"."}], "lastModified": "2011-03-08T03:07:19.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hp:nonstop:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6018065D-F606-4769-9341-9E7DEA6A0A72"}, {"criteria": "cpe:2.3:o:tandem_computers:tandem_operating_system:nsk:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CE239FDD-F33C-4E9C-B864-BE3DCC78B59B"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:websphere_mq:5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "089EDD33-4854-4894-B88D-EC560C40E2EC"}, {"criteria": "cpe:2.3:a:ibm:websphere_mq:5.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "36650BB9-861B-42B5-BCC1-492F84A64951"}, {"criteria": "cpe:2.3:a:ibm:websphere_mq:5.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "465D718A-ACA5-444B-99EE-67876B8D3687"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}