Security Bulletin: Vulnerabilities in OpenSSL affect Rational RequisitePro (CVE-2015-0209, CVE-2015-0286, CVE-2015-0289)

Summary

OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. OpenSSL is used by IBM Rational RequisitePro. RequisitePro has addressed the applicable CVEs.

Vulnerability Details

CVEID: CVE-2015-0209**
DESCRIPTION:** OpenSSL could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free error in the d2i_ECPrivateKey or EVP_PKCS82PKEY function. An attacker could exploit this vulnerability to corrupt memory and execute arbitrary code on the system and cause a denial of service.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101674 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVEID: CVE-2015-0286**
DESCRIPTION:** OpenSSL is vulnerable to a denial of service, caused by an error in the ASN1_TYPE_cmp function when attempting to compare ASN.1 boolean types. An attacker could exploit this vulnerability to crash any certificate verification operation and cause a denial of service.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101666 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2015-0289**
DESCRIPTION:** OpenSSL is vulnerable to a denial of service, caused by the failure to properly handle missing outer ContentInfo by the PKCS#7 parsing code. An attacker could exploit this vulnerability using a malformed ASN.1-encoded PKCS#7 blob to trigger a NULL pointer dereference.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101669 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Affected Products and Versions

IBM Rational RequisitePro versions:

Version

|

Status

—|—

7.1.4 through 7.1.4.7

|

Affected

7.1.3 through 7.1.3.14

|

Affected

7.1.2 through 7.1.2.17

|

Affected

7.1.1.x (all versions)

|

Affected

Not all deployments of Rational RequisitePro use OpenSSL in a way that is affected by these vulnerabilities.

You are vulnerable if your use of Rational RequisitePro includes any of these configurations:

1. You use SSL connections in perl scripts run by ratlperl or cqperl
2. You integrate with ClearQuest. See <link to ClearQuest bulletin>

Remediation/Fixes

Affected Versions

|

** Prerequisite before applying the fix**

—|—

7.1.4 through 7.1.4.7

| Install Rational RequisitePro Fix Pack 8 (7.1.4.8) for 7.1.4

7.1.3 through 7.1.3.14

| Install Rational RequisitePro Fix Pack 15 (7.1.3.15) for 7.1.3

7.1.2.x (all fix packs)
7.1.1.x (all fix packs)
7.1.0.x (all fix packs)

| Install Rational RequisitePro Fix Pack 18 (7.1.2.18) for 7.1.2. **Note:**7.1.2.18 interoperates with all 7.1.x.x systems, and can be installed in the same way as 7.1.x.x fix packs.

You should verify applying this fix does not cause any compatibility issues.

For unsupported versions, IBM recommends upgrading to a fixed, supported version/release/platform of the product.

Workarounds and Mitigations

Disable the integrations and any custom defined ratlperl or cqperl scripts with SSL until you apply the fixes listed above.