CVE-2016-0259

Vulnerability

The vulnerability resides in the runmqsc command-line interface of IBM WebSphere MQ. In versions 8.0.0.0 through 8.0.0.4, local users can execute certain display commands that return sensitive information even when they lack the required +dsp authority. The issue only affects local runmqsc sessions, not remote connections [1].

Exploitation

An attacker needs local access to the system and the ability to connect to the local queue manager via runmqsc. No authentication beyond local user access is required. The attacker simply runs unspecified display commands that should be restricted but are not properly checked for +dsp authority [1].

Impact

Successful exploitation allows a local user to obtain sensitive information from the queue manager, such as configuration details or other protected data. The impact is limited to information disclosure (confidentiality) with no effect on integrity or availability. The CVSS score is 2.5 (Low) [1].

Mitigation

The vulnerability is fixed in IBM WebSphere MQ version 8.0.0.5. Users should upgrade to this version or later. No workarounds are available [1]. The issue is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.