CVE-2024-35116
📋 TL;DR
IBM MQ versions 9.0 LTS through 9.3 CD are vulnerable to denial of service attacks when configuration changes are applied. Attackers can exploit this to disrupt MQ services, affecting organizations using these IBM MQ versions for message queuing.
💻 Affected Systems
- IBM MQ
📦 What is this software?
Mq by Ibm
Mq by Ibm
Mq by Ibm
Mq by Ibm
Mq by Ibm
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of IBM MQ, preventing message processing and causing business operations to halt.
Likely Case
Temporary service interruption during configuration changes, requiring restart or manual intervention to restore functionality.
If Mitigated
Minimal impact with proper access controls and monitoring; service may experience brief degradation but recovers quickly.
🎯 Exploit Status
Exploitation requires ability to apply configuration changes; no public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply fixes per IBM advisory: 9.0 LTS (9.0.0.19), 9.1 LTS (9.1.0.15), 9.2 LTS (9.2.0.12), 9.3 LTS (9.3.0.8), 9.3 CD (9.3.0.8)
Vendor Advisory: https://www.ibm.com/support/pages/node/7157387
Restart Required: Yes
Instructions:
1. Review IBM advisory for your specific version. 2. Download appropriate fix from IBM Fix Central. 3. Apply fix following IBM MQ update procedures. 4. Restart MQ services to activate changes.
🔧 Temporary Workarounds
Restrict Configuration Access
allLimit who can apply configuration changes to trusted administrators only.
# Use MQ security features to restrict configuration privileges
# chmqaut -m QueueManagerName -t qmgr -p UserName +connect +inq +setall
Schedule Configuration Changes
allApply configuration changes during maintenance windows with monitoring.
# Monitor MQ logs during configuration changes
# dspmqtrn -m QueueManagerName
# dspmq -o status
🧯 If You Can't Patch
- Implement strict access controls for MQ configuration management
- Monitor MQ services closely during configuration changes and have recovery procedures ready
🔍 How to Verify
Check if Vulnerable:
Check IBM MQ version using dspmqver command and compare against affected versions list.Check Version:
dspmqverVerify Fix Applied:
Verify version after patching with dspmqver and confirm it matches fixed versions in IBM advisory.📡 Detection & Monitoring
Log Indicators:
- Unexpected MQ service restarts after configuration changes
- Error messages related to configuration application failures in AMQERR01.LOG
Network Indicators:
- Sudden drop in MQ message traffic
- Connection failures to MQ services
SIEM Query:
source="mq_logs" AND ("configuration error" OR "service stopped" OR "unexpected termination")🔗 References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/290335
- https://www.ibm.com/support/pages/node/7157387
- https://www.ibm.com/support/pages/node/7158071
- https://exchange.xforce.ibmcloud.com/vulnerabilities/290335
- https://www.ibm.com/support/pages/node/7157387
- https://www.ibm.com/support/pages/node/7158071
