IBM^®App Connect Enterprise (ACE) is a powerful tool for seamless integration across your business environment, connecting disparate applications and data flows. However, like any complex system, security vulnerabilities can pose significant challenges. Recently, IBM addressed critical IBM App Connect Enterprise Vulnerabilities involving OpenSSL, which could potentially be exploited by remote attackers to cause denial-of-service (DoS) issues.

Two significant IBM App Connect Enterprise vulnerabilities were identified and fixed:

1. CVE-2024-6119: This vulnerability in OpenSSL is due to improper certificate name checks performed during TLS client operations. Exploitation by sending a specially crafted request could lead to the reading of invalid memory addresses, resulting in an abnormal application termination. This vulnerability has been given a CVSS score of 7.5, highlighting its severity. For more technical details, refer to the NIST listing for CVE-2024-6119 and Common Weakness Enumeration (CWE-843)
2. CVE-2024-5535: This issue involves a buffer over-read flaw within the SSL_select_next_proto API when processing an empty supported client protocols buffer. Exploiting this vulnerability could result in a crash or inadvertent exposure of memory contents. Although rated with a CVSS score of 3.7, which is lower than the previous vulnerability, it still poses a risk that organizations should address. More about buffer over-reads can be found here and additional information on CVE-2024-5535 can be found at the NIST site here.

These vulnerabilities impact specific versions of IBM App Connect Enterprise:

• IBM ACE 12.0.1.0 through 12.0.12.7
• IBM ACE 13.0.1.0

The APAR IT47083 addresses both vulnerabilities in these releases. To mitigate these vulnerabilities, IBM has released the following fixes:

• For IBM ACE 12.x, update to Fix Pack 12.0.12.8.
  • Available from IBM’s Download IBM App Connect Enterprise 12.0.12.8 fix pack page
• For IBM ACE 13.x, update to Fix Pack 13.0.1.1

Available from IBM’s Download IBM App Connect Enterprise 13.0.1.1 fix pack page.

Maintaining up-to-date software versions and applying patches promptly are essential best practices for any enterprise system. In addition to patching vulnerabilities as they are disclosed, continuous monitoring of your IBM App Connect Enterprise environment and automation of certain processes for will help mitigate future risks.

For users seeking advanced monitoring and management solutions for IBM ACE, Avada Software’s Infrared360 offers comprehensive tools designed to ensure visibility, performance tracking, and robust security. Anyone responsible for IBM ACE performance and/or security should see this article about essential KPIs for ACE monitoring.

Securing your integration platforms is essential to maintaining a resilient IT environment. By addressing IBM App Connect Enterprise vulnerabilities as soon as they are identified and leveraging comprehensive monitoring solutions, enterprises can safeguard their operations effectively.

For more insights and solutions related to IBM ACE and integration middleware monitoring, visit Avada Software’s blog.

• CVE-2024-49338 – JMS Credential Vulnerability