Security Bulletin: IBM WebSphere MQ is affected by a vulnerability in GSKit (CVE-2014-0076)

Summary

A vulnerability in GSKit, which is included in IBM WebSphere MQ, can potentially allow key information about certain kinds of binary type Elliptic Curves used in Digital signatures during signing operations.

Vulnerability Details

CVE-ID**:**CVE-2014-0076
DESCRIPTION: An attacker running a program on the same machine as where the victim is running a program could use CPU timing information to discover key information about certain kinds of binary type Elliptic Curves used in Digital signatures during signing operations. Although GSKit only generates Prime type Elliptic Curves, externally generated keys may be imported in GSKit.
From WebSphere MQ version 7.1, GSKit version 8.0 is integrated with WebSphere MQ. For WebSphere MQ 7.0.1, GSKit version 7 or version 8 was installed separately.

CVSS Base Score: 2.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/91990&gt;
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N)

Affected Products and Versions

IBM WebSphere MQ 8.0, including all maintenance levels.

IBM WebSphere MQ 7.5, including all maintenance levels.

IBM WebSphere MQ 7.1, including all maintenance levels.

IBM WebSphere MQ 7.0.1, maintenance levels from 7.0.1.4 onwards, using GSKit version 8.0.

Remediation/Fixes

IBM strongly recommends that Elliptic Curve CipherSpecs are not used. These CipherSpecs have names starting with ‘EC’.

A summary of MQ CipherSpecs and protocols can be found in the IBM Knowledge Center Specifying CipherSpecs topic.