Security Bulletin: IBM MQ Appliance is affected by a denial of service vulnerability (CVE-2018-18066)

Summary

IBM MQ Appliance has resolved a denial of service vulnerability.

Vulnerability Details

CVEID:CVE-2018-18066
**DESCRIPTION:**Net-SNMP is vulnerable to a denial of service, caused by an error in snmp_oid_compare in snmplib/snmp_api.c. By sending a specially-crafted UDP packet, a remote attacker could exploit this vulnerability to cause the instance to crash.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/150992 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

IBM MQ Appliance 9.1 LTS

Apply fixpack 9.1.0.6, or later.

IBM MQ Appliance 9.1 CD

Apply IBM MQ Appliance 9.2, or later.

Workarounds and Mitigations

Only affects IBM MQ Appliance when configured in a High Availability group.