Security Bulletin: Vulnerabilities in OpenSSL affect IBM Integrated Management Module (IMM) (CVE-2016-0705 CVE-2016-0797 CVE-2016-0798 CVE-2016-0799)

Summary

OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM Integrated Management Module (IMM) which has addressed the applicable CVEs.

Vulnerability Details

Summary

OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM Integrated Management Module (IMM) which has addressed the applicable CVEs.

IBM Integrated Management Module (IMM) is not vulnerable to CVE-2016-0800, also known as the DROWN attack.

Vulnerability Details

CVE-ID: CVE-2016-0705

Description: OpenSSL is vulnerable to a denial of service, caused by a double-free error when parsing DSA private keys. An attacker could exploit this vulnerability to corrupt memory and cause a denial of service.

CVSS Base Score: 3.7
CVSS Temporal Score: See <http://exchange.xforce.ibmcloud.com/vulnerabilities/111140&gt; for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVE-ID: CVE-2016-0797

Description: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference in the BN_hex2bn/BN_dec2bn() function. An attacker could exploit this vulnerability using specially crafted data to cause a denial of service.

CVSS Base Score: 3.7
CVSS Temporal Score: See <http://exchange.xforce.ibmcloud.com/vulnerabilities/111142&gt; for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVE-ID: CVE-2016-0798

Description: OpenSSL is vulnerable to a denial of service, caused by a memory leak in SRP servers. An attacker could exploit this vulnerability using a specially crafted username value to cause a denial of service.

CVSS Base Score: 3.7
CVSS Temporal Score: See <http://exchange.xforce.ibmcloud.com/vulnerabilities/111141&gt; for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVE-ID: CVE-2016-0799

Description: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a memory error in the BIO_*printf() functions. An attacker could exploit this vulnerability using specially crafted data to trigger an out-of-bounds read.

CVSS Base Score: 3.7
CVSS Temporal Score: See <http://exchange.xforce.ibmcloud.com/vulnerabilities/111143&gt; for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected products and versions

Remediation/Fixes

Firmware fix versions are available on Fix Central: <http://www.ibm.com/support/fixcentral/&gt;

You should verify applying this fix does not cause any compatibility issues.

Workarounds and Mitigations

None.

References

• Complete CVSS V3 Guide
• On-line Calculator V3

Related Information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Acknowledgement

None.

Change History
23 May 2016: Original Version Published