CVE-2016-0360
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary Java code on systems running vulnerable IBM WebSphere MQ JMS clients by exploiting insecure deserialization of untrusted data. It affects IBM WebSphere MQ JMS clients versions 7.0.1 through 9.0. Attackers can achieve remote code execution by manipulating the classpath.
💻 Affected Systems
- IBM WebSphere MQ JMS Client
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution as the application user, potentially leading to data theft, lateral movement, or ransomware deployment.
Likely Case
Remote code execution leading to application compromise, data exfiltration, or installation of backdoors.
If Mitigated
Limited impact if proper network segmentation, least privilege, and input validation are implemented.
🎯 Exploit Status
Deserialization vulnerabilities are commonly exploited using public tools like ysoserial. Attack requires ability to influence classpath or send malicious serialized objects.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply fixes per IBM advisory: 7.0.1.13, 7.1.0.9, 7.5.0.8, 8.0.0.7, 9.0.0.2
Vendor Advisory: http://www-01.ibm.com/support/docview.wss?uid=swg21983457
Restart Required: Yes
Instructions:
1. Review IBM advisory 1983457. 2. Download appropriate fix pack for your version. 3. Apply fix following IBM installation procedures. 4. Restart affected services.
🔧 Temporary Workarounds
Restrict Classpath Access
linuxPrevent unauthorized users from adding classes to the JMS client classpath.
chmod 750 /path/to/websphere/lib/*
chown root:websphere /path/to/websphere/lib/*
Network Segmentation
linuxIsolate WebSphere MQ JMS clients from untrusted networks.
iptables -A INPUT -p tcp --dport 1414 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 1414 -j DROP
🧯 If You Can't Patch
- Implement strict network controls to limit client exposure to trusted sources only.
- Use Java Security Manager with restrictive policies to limit deserialization capabilities.
🔍 How to Verify
Check if Vulnerable:
Check WebSphere MQ version using 'dspmqver' command and compare against affected versions.Check Version:
dspmqverVerify Fix Applied:
Verify installed fix pack version matches IBM's patched versions using 'dspmqver' or check installed fix packs in WebSphere administration console.📡 Detection & Monitoring
Log Indicators:
- Java exceptions related to deserialization in WebSphere logs
- Unexpected class loading events
- Unusual process execution from WebSphere JVM
Network Indicators:
- Unusual connections to WebSphere MQ ports (1414, 1415) from untrusted sources
- Large serialized objects being sent to JMS endpoints
SIEM Query:
source="websphere.log" AND ("ClassNotFoundException" OR "InvalidClassException" OR "NotSerializableException")