Vulnerabilities in OpenSSL affect AIX

IBM SECURITY ADVISORY

First Issued: Tue Jul 12 14:14:43 CDT 2016

The most recent version of this document is available here:

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory20.asc
https://aix.software.ibm.com/aix/efixes/security/openssl_advisory20.asc
ftp://aix.software.ibm.com/aix/efixes/security/openssl_advisory20.asc

Security Bulletin: Vulnerabilities in OpenSSL affect AIX (CVE-2016-2176
CVE-2016-2109 CVE-2016-2108 CVE-2016-2106 CVE-2016-2105)

===============================================================================

SUMMARY:

This bulletin addresses CVE-2016-2176 CVE-2016-2109 CVE-2016-2108 
CVE-2016-2106 CVE-2016-2105 for AIX.

===============================================================================

VULNERABILITY DETAILS:

CVEID: CVE-2016-2176
DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive
information, by sending an overly long ASN.1 string to the 
X509_NAME_oneline() function. An attacker could exploit this vulnerability
to return arbitrary stack data in the buffer.
CVSS Base Score: 5.3
CVSS Temporal Score: See 
    https://exchange.xforce.ibmcloud.com/vulnerabilities/112858 for the 
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:P)

CVEID: CVE-2016-2109
DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a 
memory allocation error. By reading specially crafted ASN.1 data from a BIO 
using functions such as d2i_CMS_bio(), an attacker could exploit this 
vulnerability to consume all available resources and exhaust memory.
CVSS Base Score:  5.3
CVSS Temporal Score: See 
    https://exchange.xforce.ibmcloud.com/vulnerabilities/112857 for the 
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:C)

CVEID: CVE-2016-2108
DESCRIPTION: OpenSSL could allow a remote attacker to execute arbitrary code
on the system, caused by a buffer underflow when deserializing untrusted ASN.1
structures and later reserializes them. An attacker could exploit this 
vulnerability to corrupt memory and trigger an out-of-bounds write and execute 
arbitrary code on the system.
CVSS Base Score: 8.1
CVSS Temporal Score: See 
    https://exchange.xforce.ibmcloud.com/vulnerabilities/112853 for the 
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVEID: CVE-2016-2106
DESCRIPTION: OpenSSL is vulnerable to a heap-based buffer overflow, caused by 
improper bounds checking by the EVP_EncryptUpdate() function. By sending an overly 
long argument, a remote attacker could overflow a buffer and execute arbitrary 
code on the system or cause the application to crash.
CVSS Base Score: 5.6
CVSS Temporal Score: See 
    https://exchange.xforce.ibmcloud.com/vulnerabilities/112856 for the 
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2016-2105
DESCRIPTION: OpenSSL is vulnerable to a heap-based buffer overflow, caused by
improper bounds checking by the EVP_EncodeUpdate() function. By sending an overly
long argument, a remote attacker could overflow a buffer and execute arbitrary
code on the system or cause the application to crash.
CVSS Base Score: 5.6
CVSS Temporal Score: See
https://exchange.xforce.ibmcloud.com/vulnerabilities/112855 for the
current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

AFFECTED PRODUCTS AND VERSIONS:

    AIX 5.3, 6.1, 7.1, 7.2
    VIOS 2.2.x

    The following fileset levels are vulnerable:
    
    key_fileset = osrcaix

    Fileset          Lower Level   Upper Level  KEY 
    --------------------------------------------------
    openssl.base     0.9.8.401     0.9.8.2506   key_w_fs
    openssl.base     1.0.1.500     1.0.1.515    key_w_fs
    openssl.base     1.0.2.500     1.0.2.500    key_w_fs
    openssl.base    12.9.8.1100   12.9.8.2506   key_w_fs
    openssl.base    20.11.101.500 20.11.101.500 key_w_fs

    Note, 0.9.8.401 and 12.9.8.1100 are the Lowest OpenSSL version
    available in aix web download site. Even OpenSSL versions below 
    this are impacted.

    Note:  To find out whether the affected filesets are installed 
    on your systems, refer to the lslpp command found in AIX user's guide.

    Example:  lslpp -L | grep -i openssl.base

REMEDIATION:

    A. FIXES

        A fix is available, and it can be downloaded from:

        https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=aixbp

        To extract the fixes from the tar file:

        For Openssl 1.0.1 version - 
        zcat openssl-1.0.1.516.tar.Z | tar xvf -
        For Openssl 0.9.8 version - 
        zcat openssl-0.9.8.2507.tar.Z | tar xvf -
        For Openssl 12.9.8 version - 
        zcat openssl-12.9.8.2507.tar.Z | tar xvf -
        For Openssl 1.0.2 version - 
        zcat openssl-1.0.2.800.tar.Z | tar xvf -
        For Openssl 20.11.101 version - 
        zcat openssl-20.11.101.501.tar.Z | tar xvf -      

        IMPORTANT: If possible, it is recommended that a mksysb backup
        of the system be created.  Verify it is both bootable and
        readable before proceeding.

        Note that all the previously reported security vulnerability fixes is also
        included in above mentioned fileset level. Please refer to the readme file 
        (provided along with the fileset) for the complete list of vulnerabilities fixed.

        To preview the fix installation:

        installp -apYd . openssl

        To install the fix package:

        installp -aXYd . openssl
        
        openssl dgst -sha1 -verify <pubkey_file> -signature <advisory_file>.sig <advisory_file>

        openssl dgst -sha1 -verify <pubkey_file> -signature <ifix_file>.sig <ifix_file>

        Published advisory OpenSSL signature file location:

        http://aix.software.ibm.com/aix/efixes/security/openssl_advisory20.asc.sig
        https://aix.software.ibm.com/aix/efixes/security/openssl_advisory20.asc.sig
        ftp://aix.software.ibm.com/aix/efixes/security/openssl_advisory20.asc.sig 


WORKAROUNDS AND MITIGATIONS:

    None.

===============================================================================

CONTACT US:

Note: Keywords labeled as KEY in this document are used for parsing
purposes.

If you would like to receive AIX Security Advisories via email,
please visit "My Notifications":

    http://www.ibm.com/support/mynotifications

To view previously issued advisories, please visit:

    http://www14.software.ibm.com/webapp/set2/subscriptions/onvdq

Comments regarding the content of this announcement can be
directed to:

    [email protected]

To obtain the OpenSSL public key that can be used to verify the
signed advisories and ifixes:

    Download the key from our web page:

http://www.ibm.com/systems/resources/systems_p_os_aix_security_pubkey.txt

To obtain the PGP public key that can be used to communicate
securely with the AIX Security Team via [email protected] you
can :

    A. Download the key from our web page:

        http://www.ibm.com/systems/resources/systems_p_os_aix_security_pgppubkey.txt

    B. Download the key from a PGP Public Key Server. The key ID is:

        0x28BFAA12

Please contact your local IBM AIX support center for any
assistance.

REFERENCES:

Note: Keywords labeled as KEY in this document are used for parsing purposes.

eServer is a trademark of International Business Machines
Corporation.  IBM, AIX and pSeries are registered trademarks of
International Business Machines Corporation.  All other trademarks
are property of their respective holders.

Complete CVSS Guide: http://www.first.org/cvss/cvss-guide.html
On-line Calculator V2: http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2

X-Force Vulnerability Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/112858
X-Force Vulnerability Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/112857
X-Force Vulnerability Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/112853
X-Force Vulnerability Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/112856
X-Force Vulnerability Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/112855
CVE-2016-2176 : https://vulners.com/cve/CVE-2016-2176
CVE-2016-2109 : https://vulners.com/cve/CVE-2016-2109
CVE-2016-2108 : https://vulners.com/cve/CVE-2016-2108
CVE-2016-2106 : https://vulners.com/cve/CVE-2016-2106
CVE-2016-2105 : https://vulners.com/cve/CVE-2016-2105

ACKNOWLEDGEMENTS:

None.

CHANGE HISTORY:

First Issued: Tue Jul 12 14:14:43 CDT 2016

===============================================================================

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an “industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response.” IBM PROVIDES THE CVSS SCORES “AS IS” WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.