Werk #16615: Remove websphere_mq plugin

Component

Checks & agents

Title

Remove websphere_mq plugin

Date

Mar 11, 2024

Level

Trivial Change

Class

Security Fix

Compatibility

Incompatible - Manual interaction might be required

Checkmk versions & editions

2.4.0b1 Not yet released	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.3.0b5	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.2.0p26	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)

With this Werk the websphere_mq plugin is removed for security reasons.

In this plugin the output of ps is used to determine an argument for runmqsc. This meant that anybody who can launch processes with an arbitrary command line could manipulate one argument to runmqsc.

The plugin was already superseded by the agent plugin ibm_mq and deprecated with Werk 10752 and version 2.0.0.

Since this plugin is already deprecated and it was not configurable via the agent bakery we assumed that this plugin is not frequently used. Therefore we decided to not fix the issue but to push the removal.

We found this vulnerability internally.

Affected versions:

2.3.0
2.2.0
2.1.0
2.0.0

Mitigations:

Migrate to the ibm_mq plugin.

Vulnerability Management:

We have rated the issue with a CVSS Score of 6.5 (Medium) with the following CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N. We assigned CVE-2024-3367 to this vulnerability.

Changes:

The plugin was removed.

To the list of all Werks