Security Bulletin: IBM Spectrum Scale Object Protocols functionality (Linux Standard and Advanced) is affected by security vulnerabilities in the TLS and SSL protocols (CVE-2015-2808 and CVE-2014-3566)

Summary

IBM Spectrum Scale Object Protocols functionality (Linux Standard and Advanced) is affected by security vulnerabilities in the TLS and SSL protocols (CVE-2015-2808 and CVE-2014-3566)

Vulnerability Details

CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this vulnerability to remotely expose account credentials without requiring an active man-in-the-middle session. Successful exploitation could allow an attacker to obtain sensitive information. This vulnerability is commonly referred to as “Bar Mitzvah Attack”.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101851 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVEID: CVE-2014-3566 DESCRIPTION: Multiple products could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via the POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and calculate the plaintext of secure connections.
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/97013 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Affected Products and Versions

IBM Spectrum Scale Object Protocols (Linux Standard and Advanced)
V4.2.0.0 thru V4.2.0.4
V4.2.1.0 thru V4.2.1.1

Remediation/Fixes

For IBM Spectrum Scale V4.2.0.0 thru V4.2.0.4 and V4.2.1.0 thru V4.2.1.1, obtain V4.2.1.2 from Fix Central at:

https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%2Bdefined%2Bstorage&product=ibm/StorageSoftware/IBM+Spectrum+Scale&release=4.2.1&platform=All&function=all

If you cannot apply the latest level of service, contact IBM Service for an efix:

• For IBM Spectrum Scale V4.2.0.0 thru V4.2.0.4, reference APAR IV90176
• For IBM Spectrum Scale V4.2.1.0 thru V4.2.1.1, reference APAR IV90174

Workarounds and Mitigations

This procedure is applicable only if :
- Your cluster is running IBM Spectrum Scale V4.2.0.0 thru V4.2.0.4, or V4.2.1.0 thru V4.2.1.1
- Object is enabled
- Object Authentication is set to local,ad, or**ldap **
- SSL is enabled for Keystone

The following steps need to be issued from the protocol node where object is running:

1. Create a copy of the** wsgi-keystone.conf** file:

cp /etc/httpd/conf.d/wsgi-keystone.conf /tmp/

2. Update the /tmp/wsgi-keystone.conffile to add following two lines in virtual hosts for keystone:

SSLProtocol All -SSLv2 -SSLv3
SSLCipherSuite ALL:!ADH:!RC4:+HIGH:+MEDIUM:!LOW:!SSLv2:!SSLV3:!EXPORT

The updated** /tmp/wsgi-keystone.conf** file will look similar to the following:

WSGISocketPrefix /var/run/wsgi
SetEnv APACHE_RUN_USER keystone
SetEnv APACHE_RUN_GROUP keystone
LoadModule ssl_module modules/mod_ssl.so
<VirtualHost *:5000>
SSLEngine on
SSLCertificateFile /etc/keystone/ssl/certs/ssl_cert.pem
SSLCertificateKeyFile /etc/keystone/ssl/private/ssl_key.pem
SSLCipherSuite ALL:!ADH:!RC4:+HIGH:+MEDIUM:!LOW:!SSLv2:!SSLV3:!EXPORT
SSLProtocol All -SSLv2 -SSLv3
WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=keystone-public
WSGIProcessGroup keystone-public
WSGIImportScript /var/www/cgi-bin/keystone/main process-group=keystone-public application-group=%{GLOBAL}
WSGIScriptAlias / /var/www/cgi-bin/keystone/main
ErrorLog /var/log/keystone/httpd-error.log
LogLevel info
CustomLog /var/log/keystone/httpd-access.log combined
LimitRequestBody 16384
</VirtualHost>
Listen 35357
<VirtualHost *:35357>
SSLEngine on
SSLCertificateFile /etc/keystone/ssl/certs/ssl_cert.pem
SSLCertificateKeyFile /etc/keystone/ssl/private/ssl_key.pem
SSLCipherSuite ALL:!ADH:!RC4:+HIGH:+MEDIUM:!LOW:!SSLv2:!SSLV3:!EXPORT
SSLProtocol All -SSLv2 -SSLv3
WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=keystone-admin
WSGIProcessGroup keystone-admin
WSGIImportScript /var/www/cgi-bin/keystone/main process-group=keystone-admin application-group=%{GLOBAL}
WSGIScriptAlias / /var/www/cgi-bin/keystone/admin
ErrorLog /var/log/keystone/httpd-error.log
LogLevel info
CustomLog /var/log/keystone/httpd-access.log combined
LimitRequestBody 16384

3. Upload the wsgi-keystone.conffile to the cluster configuration repository:

mmccr fput wsgi-keystone.conf /tmp/wsgi-keystone.conf

The fix will be in effect after restarting object services on protocol nodes. One can choose to restart object service on all nodes(Step 4a) or restart services on all nodes one node at a time(Step 4b).

4a. Stop and Start Object services on all nodes:

/usr/lpp/mmfs/bin/mmces service stop obj -a
/usr/lpp/mmfs/bin/mmces service start obj -a

4b. Stop and Start Object services on one node at a time for all nodes in a cluster:

/usr/lpp/mmfs/bin/mmces service stop obj -N nodename
/usr/lpp/mmfs/bin/mmces service start obj -N nodename

Notes :
1. After authentication reconfiguration or disabling and re-enabling object, steps need to rerun.
2. If the keystone.conf parameter was updated using themmobj config change command, then object services need to restarted to have the changes take affect.