Lucene search

K
ibmIBM0E99885794CFEB4EA92D09FA1554D46778136AD4F14F1A4027E56C6509C20B72
HistoryJun 28, 2023 - 10:05 p.m.

Security Bulletin: Multiple security vulnerabilities have been identified in Open SSL, which is shipped with IBM Tivoli Network Manager IP Edition (CVE-2017-3737, CVE-2017-3738).

2023-06-2822:05:48
www.ibm.com
2

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.946 High

EPSS

Percentile

99.2%

Summary

Open SSL is shipped with IBM Tivoli Network Manager IP Edition version 3.9. Information about security vulnerabilities affecting Open SSL has been published here.

Vulnerability Details

CVEID: CVE-2017-3737 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. An attacker could exploit this vulnerability to obtain information about the private key. Note: In order to exploit this vulnerability, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701.
CVSS Base Score: 3.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/136078&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2017-3738 DESCRIPTION: An unspecified vulnerability in multiple Oracle products could allow an unauthenticated attacker to cause low confidentiality impact, low integrity impact, and high availability impact.
CVSS Base Score: 5.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/136077&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

IBM Tivoli Network Manager IP Edition v3.9 Fix Pack 4 & Fix Pack 5.

Remediation/Fixes

IBM Tivoli Network Manager IP Edition 3.9 FP4 and FP5 |APAR IJ07985 |

Please call IBM service and reference APAR IJ07985, to obtain a fix.

—|—|—

Please also note the end of support announcement from 12 September 2017 for selected Netcool product versions.
You can find detailed information on whether the product version you have installed in your environment is affected by this end of service announcement by following the Netcool End of Support Knowledge Collection. If your product version is affected, IBM recommend to upgrade your product version to the latest supported version of your product.
Please contact your IBM account manager for any question you might have or for any assistance you may require for upgrading an end of service announced offering.

Workarounds and Mitigations

None.

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.946 High

EPSS

Percentile

99.2%

Related for 0E99885794CFEB4EA92D09FA1554D46778136AD4F14F1A4027E56C6509C20B72