IBM CICS TX and TXSeries for Multiplatforms Arbitrary Code Execution Vulnerability

A vulnerability allowing local users to execute arbitrary code has been identified in IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1. This issue arises from the products' improper handling of DNS return requests by the gethostbyname function, leading to an out-of-bounds write vulnerability. Additionally, according to IBM, this vulnerability involves the use of inherently dangerous functions, which can also be exploited to execute arbitrary code.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of arbitrary code on the affected system.

Remediation

Users are advised to upgrade to IBM CICS TX Advanced 10.1 or 11.1.0.0. If using version 10.1, download the fix from Fix Central. For version 11.1, also download the fix from Fix Central.