Werk #16615: Remove websphere_mq plugin

Komponente

Checks & agents

Titel

Remove websphere_mq plugin

Datum

11.03.2024

Level

Kleine Änderung

Klasse

Sicherheitsfix

Kompatibilität

Inkompatibel - Manuelle Interaktion könnte erforderlich sein

Checkmk versions & editions

2.4.0b1	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.3.0b5	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.2.0p26	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)

With this Werk the websphere_mq plugin is removed for security reasons.

In this plugin the output of ps is used to determine an argument for runmqsc. This meant that anybody who can launch processes with an arbitrary command line could manipulate one argument to runmqsc.

The plugin was already superseded by the agent plugin ibm_mq and deprecated with Werk 10752 and version 2.0.0.

Since this plugin is already deprecated and it was not configurable via the agent bakery we assumed that this plugin is not frequently used. Therefore we decided to not fix the issue but to push the removal.

We found this vulnerability internally.

Affected versions:

2.3.0
2.2.0
2.1.0
2.0.0

Mitigations:

Migrate to the ibm_mq plugin.

Vulnerability Management:

We have rated the issue with a CVSS Score of 6.5 (Medium) with the following CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N. We assigned CVE-2024-3367 to this vulnerability.

Changes:

The plugin was removed.

Zur Liste aller Werks