Security Bulletin: Vulnerability in IBM Java Runtime affects Rational Publishing Engine (CVE-2015-7575)

Summary

There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Versions 6 and 7 that are used by Rational Publishing Engine. This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016.

Vulnerability Details

CVEID: CVE-2015-7575**
DESCRIPTION:** The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message during a TLS handshake. An attacker could exploit this vulnerability using man-in-the-middle techniques to impersonate a TLS server and obtain credentials. This vulnerability is commonly referred to as “SLOTH”.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/109415 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/UI:U/C:H/I:L/A:N)

Affected Products and Versions

Rational Publishing Engine 1.2.x
Rational Publishing Engine 1.3.0
Rational Publishing Engine 2.0.0
Rational Publishing Engine 2.0.1

Remediation/Fixes

For RPE 1.2.x: <ftp://ftp.software.ibm.com/software/rational/private/RPE-KHYRXNbcDwtP/&gt;

For RPE 1.3.0, RPE 2.0.0 and RPE 2.0.1: <https://www.ibm.com/software/repositorymanager/com.ibm.rational.rpe.offering/repository.xml&gt;

For RPE 1.1.x IBM recommends upgrading to a fixed, supported version/release/platform of the product.

Workarounds and Mitigations

For CVE-2015-7575:

Users of Java 7 and later can address the issue by updating the /jre/lib/security/java.security file as follows (both steps are required):

· Add MD5 to the jdk.certpath.disabledAlgorithms property - e.g. jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024, MD5

· Add MD5withRSA to the jdk.tls.disabledAlgorithms property - e.g. jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 768, MD5withRSA

Java 6 requires code changes in the JSSE component in addition to the java.security file modifications, so upgrading the JDK is the only solution.