CVE-2018-1371 Null dereference in MQ

Medium 6.5 Published 17 Apr 2018 Updated 16 Sep 2024

A client connection can trigger a segmentation fault in the channel process, causing a denial of service for IBM WebSphere MQ administrators.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-1371?

CVE-2018-1371 is a medium-severity vulnerability in Ibm Websphere Mq, published on 17 Apr 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An IBM WebSphere MQ 8.0.0.8, 9.0.0.2, and 9.0.4 Client connecting to a MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process terminating it. IBM X-Force ID: 137771.

Which versions are affected by CVE-2018-1371?

It affects 1 product.

Products include Ibm Websphere Mq.

How do I fix CVE-2018-1371?

No fix has been published for CVE-2018-1371 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-1371 being exploited?

There is no known exploitation of CVE-2018-1371 in the wild and no public exploit code.

All Ibm Websphere Mq vulnerabilities

Sources

Also known as GHSA-854x-j9wg-w8jp.