Security Bulletin: Tivoli Storage Manager Server Certificate Chaining Vulnerability (CVE-2013-6747 )

Summary

A certificate chain presented by a Client or Server could contain a circular reference that will cause the chain building logic to loop, crash or hang.

Vulnerability Details

CVE ID: CVE-2013-6747

DESCRIPTION:
A certificate chain presented by a Client or Server could contain a circular reference that will cause the chain building logic to loop which can lead to a segv crash or hang due to memory exhaustion.

CVSS Base Score: 7.1

CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/89863&gt; for the current score

CVSS Environmental Score*: Undefined

CVSS Vector:(AV/N:AC/M:Au/N:C/N:I/N:A/C)

Affected Products and Versions

IBM Tivoli Storage Manager server release levels:

· 7.1.0 (all servers and storage agents)

· 6.3.0 through 6.3.4.30 (all servers)

· 6.3.3 through 6.3.4.30 (all storage agents)

· 6.2.0 through 6.2.6.0 (all servers)

· 6.1.0 through 6.1.5.xxx (AIX and Windows servers only)

· 5.5.0 through 5.5.7.xxx (AIX and Windows servers only)

Remediation/Fixes

The recommended solution is to apply the fixes as soon as practical. Please see below for information on the fixes available and the links where the fixes can be downloaded.

Workarounds and Mitigations

Remove the ability for users to use SSL sessions by changing the server and/or storage agent option files to remove the SSL communication options