CVE-2014-3042 - Vulnerability Details - OpenCVE

IBM CICS Transaction Server 3.1, 3.2, 4.1, 4.2, and 5.1 on z/OS does not properly implement CEMT transactions, which allows remote authenticated users to cause a denial of service (storage overlay) by using a 3270 emulator to send an invalid 3270 data stream.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00849.

Key SSVC decision points have not yet been added.

Vendors	Products
Ibm Subscribe	Cics Transaction Server Subscribe

Configuration 1 [-]

OR	cpe:2.3:a:ibm:cics_transaction_server:-:-:-::-:z\/os::*
	cpe:2.3:a:ibm:cics_transaction_server:3.1:-:-::-:z\/os::*
	cpe:2.3:a:ibm:cics_transaction_server:3.2:-:-:::z\/os::
	cpe:2.3:a:ibm:cics_transaction_server:4.1:-:-::-:z\/os::*
	cpe:2.3:a:ibm:cics_transaction_server:5.1:-:-::-:z\/os::*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2014-3063	IBM CICS Transaction Server 3.1, 3.2, 4.1, 4.2, and 5.1 on z/OS does not properly implement CEMT transactions, which allows remote authenticated users to cause a denial of service (storage overlay) by using a 3270 emulator to send an invalid 3270 data stream.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://secunia.com/advisories/59242
http://www-01.ibm.com/support/docview.wss?uid=swg1PI16710
http://www-01.ibm.com/support/docview.wss?uid=swg1PI16726
http://www-01.ibm.com/support/docview.wss?uid=swg1PI16727
http://www-01.ibm.com/support/docview.wss?uid=swg21675195
http://www.securityfocus.com/bid/67944
https://exchange.xforce.ibmcloud.com/vulnerabilities/93338

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2014-06-10T10:00:00

Updated: 2024-08-06T10:28:46.383Z

Reserved: 2014-04-29T00:00:00

Link: CVE-2014-3042

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2014-06-10T11:19:35.453

Modified: 2025-04-12T10:46:40.837

Link: CVE-2014-3042

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-119

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-06-06T00:00:00", "descriptions": [{"lang": "en", "value": "IBM CICS Transaction Server 3.1, 3.2, 4.1, 4.2, and 5.1 on z/OS does not properly implement CEMT transactions, which allows remote authenticated users to cause a denial of service (storage overlay) by using a 3270 emulator to send an invalid 3270 data stream."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"name": "PI16710", "tags": ["vendor-advisory", "x_refsource_AIXAPAR"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI16710"}, {"name": "67944", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/67944"}, {"name": "PI16727", "tags": ["vendor-advisory", "x_refsource_AIXAPAR"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI16727"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21675195"}, {"name": "59242", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/59242"}, {"name": "PI16726", "tags": ["vendor-advisory", "x_refsource_AIXAPAR"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI16726"}, {"name": "ibm-cicsts-cve20143042-overlay(93338)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/93338"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "ID": "CVE-2014-3042", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "IBM CICS Transaction Server 3.1, 3.2, 4.1, 4.2, and 5.1 on z/OS does not properly implement CEMT transactions, which allows remote authenticated users to cause a denial of service (storage overlay) by using a 3270 emulator to send an invalid 3270 data stream."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "PI16710", "refsource": "AIXAPAR", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI16710"}, {"name": "67944", "refsource": "BID", "url": "http://www.securityfocus.com/bid/67944"}, {"name": "PI16727", "refsource": "AIXAPAR", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI16727"}, {"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21675195", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21675195"}, {"name": "59242", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/59242"}, {"name": "PI16726", "refsource": "AIXAPAR", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI16726"}, {"name": "ibm-cicsts-cve20143042-overlay(93338)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/93338"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T10:28:46.383Z"}, "title": "CVE Program Container", "references": [{"name": "PI16710", "tags": ["vendor-advisory", "x_refsource_AIXAPAR", "x_transferred"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI16710"}, {"name": "67944", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/67944"}, {"name": "PI16727", "tags": ["vendor-advisory", "x_refsource_AIXAPAR", "x_transferred"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI16727"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21675195"}, {"name": "59242", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/59242"}, {"name": "PI16726", "tags": ["vendor-advisory", "x_refsource_AIXAPAR", "x_transferred"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI16726"}, {"name": "ibm-cicsts-cve20143042-overlay(93338)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/93338"}]}]}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2014-3042", "datePublished": "2014-06-10T10:00:00", "dateReserved": "2014-04-29T00:00:00", "dateUpdated": "2024-08-06T10:28:46.383Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:cics_transaction_server:-:-:-:*:-:z\\/os:*:*", "matchCriteriaId": "84B8DE50-ABF3-4E94-8319-AEF8715E1DF8", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:cics_transaction_server:3.1:-:-:*:-:z\\/os:*:*", "matchCriteriaId": "35E21A2A-4051-4986-9A34-BD13843D5B2B", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:cics_transaction_server:3.2:-:-:*:*:z\\/os:*:*", "matchCriteriaId": "5B9764BE-DDAA-4139-9724-5AFCB3CCF39D", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:cics_transaction_server:4.1:-:-:*:-:z\\/os:*:*", "matchCriteriaId": "9D4FF2E9-E172-484F-B087-EFDD39CEB79B", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:cics_transaction_server:5.1:-:-:*:-:z\\/os:*:*", "matchCriteriaId": "306F8C33-929E-4A3E-933A-7C9665AA2CCB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM CICS Transaction Server 3.1, 3.2, 4.1, 4.2, and 5.1 on z/OS does not properly implement CEMT transactions, which allows remote authenticated users to cause a denial of service (storage overlay) by using a 3270 emulator to send an invalid 3270 data stream."}, {"lang": "es", "value": "IBM CICS Transaction Server 3.1, 3.2, 4.1, 4.2 y 5.1 en z/OS no implementa debidamente las transacciones CEMT, lo que permite a usuarios remotos autenticados causar una denegaci\u00f3n de servicio (superposici\u00f3n de almacenamiento) mediante el uso de un emulador 3270 para enviar un flujo de datos 3270 inv\u00e1lido."}], "id": "CVE-2014-3042", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-06-10T11:19:35.453", "references": [{"source": "psirt@us.ibm.com", "url": "http://secunia.com/advisories/59242"}, {"source": "psirt@us.ibm.com", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI16710"}, {"source": "psirt@us.ibm.com", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI16726"}, {"source": "psirt@us.ibm.com", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI16727"}, {"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21675195"}, {"source": "psirt@us.ibm.com", "url": "http://www.securityfocus.com/bid/67944"}, {"source": "psirt@us.ibm.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/93338"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/59242"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI16710"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI16726"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI16727"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21675195"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/67944"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/93338"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}