Company

Technical Security Consulting

Managing Risk

Research & Development

Forensics

Security Management

Media Centre

PCI DSS

• Home
• Overview
• R&D Services
• Technology Focus
• Messaging Systems Security
• Embedded Systems Security
• Collaborative Research Projects
• Technical Whitepapers
• Research Briefings
• Publicly Released Tools
• Vendor Alerts - 0days
• Security Advisories

Messaging System Security

---

Enterprise messaging systems aim to connect independent business applications that may cross different platforms, languages and business boundaries. The following technologies are examples of research that have been performed by IRM:

IBM WebSphere MQ Security

TIBCO Rendezvous Security

Progress SonicMQ Security

FioranoMQ Security

The PGM (Pragmatic General Multicast) Protocol

---

Messaging Systems Security Assessments

Messaging Systems Testing Datasheet (PDF 54.5 KB) 

Messaging Systems Testing Methodology (PDF 297 KB) 

---

 

IBM WebSphere MQ

Research performed by IRM has resulted in the development of a comprehensive security testing methodology for WebSphere MQ, a range of security assessment tools and most recently the discovery of six remote vulnerabilities in WebSphere MQ 6.0.

A management summary of the high level threats facing Enterprise WebSphere MQ installations is available to download below: 

WebSphere MQ Threats - A Management Summary

 

TIBCO Rendezvous

IRM have performed a range of research projects investigating the security of TIBCO Rendezvous (commonly referred to as “RV”). One example included the development of a comprehensive security testing methodology that highlights weaknesses in the configuration of existing TIBCO RV deployments. A further project looked at the security of the proprietary RV “wire format” network protocol, which resulted in the discovery of a remote DoS vulnerability in the RV daemon, which if exploited could result in all RV communication failing and preventing any further messages from being transmitted or received.

A video has been produced, which highlights the potential impact of the remote DoS vulnerability discovered by IRM. 

IRM are regularly asked by clients to assess the security of their TIBCO RV installations as a result of the knowledge and expertise developed during previous research projects and security engagements. 

 

Previous TIBCO Research:

Security Testing Enterprise Messaging Systems

Remote DoS Vulnerability in the TIBCO RV Daemon

 

Messaging Systems Research 

Ongoing research is being performed against all the industry leading messaging systems. The research comprises not only the discovery of vulnerabilities arising from software flaws in the products, but also configurations that may lead to the introduction of weaknesses within an infrastructure along with architectural issues that have an impact on security. As new discoveries are made, they will be publicy reported by IRM following resposible disclosure.

 

---

The PGM (Pragmatic General Multicast) Protocol

PGM is a reliable multicast transport protocol developed by a range of vendors including Cisco and TIBCO and described in RFC3208. The protocol is used in various messaging and middleware products, including TIBCO Rendezvous, SmartSockets and SmartPGM FX. 

IRM have discovered a range of PGM vulnerabilities in TIBCO products and have developed a tool, PGMfuzz, for identifying vulnerabilities in PGM option parsing implementations.