SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 is enabled in IBM Tivoli Netcool Configuration Manager.
CVE-ID: CVE-2014-3566
DESCRIPTION: Product could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and access the plaintext of encrypted connections.
__CVSS Base Score: 4.3
CVSS Temporal Score: See __https://exchange.xforce.ibmcloud.com/vulnerabilities/97013__ **** for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)__
· Affected releases/versions/platforms: 6.2.x, 6.3.0.6, 6.4.1.1 and earlier
· Releases/systems/configurations NOT affected: None
Upgrade to the latest available fixpack.
Product version | Fix Date | Notes |
---|---|---|
6.4.1.x | 19. March 2015 | _Fixed from __6.4.1-TIV-ITNCM-LINUX-FP002 __onwards. _available from fix central. |
6.4.0.x | 19. March 2015 | 6.4.0.3 is remediated by 6.4.1.2. ITNCM is merging the streams so it is advised that customers upgrade to 6.4.1.2 6.4.1-TIV-ITNCM-LINUX-FP002 available from fix central. |
6.3.x | 29. January 2015 | _Fixed from _6.3.0.6-TIV-ITNCM-IF001 onwards. Available from fix central. |
6.2.x | None | Please contact support. |
SSL users should disable SSLv3 using the following workaround outlined here: http://www-01.ibm.com/support/docview.wss?uid=swg21687173
IBM recommends that you review your entire environment to identify other areas that enable the SSLv3 protocol and take appropriate mitigation such as disabling SSLv3 and remediation actions.