Security Bulletin: Vulnerability in SSLv3 affects IBM Sterling Connect:Direct for i5/OS (CVE-2014-3566)

Summary

SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 is enabled in IBM Sterling Connect:Direct for i5/OS.

Vulnerability Details

CVE-ID: CVE-2014-3566

DESCRIPTION: Product could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and access the plaintext of encrypted connections.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/97013&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Affected Products and Versions

Sterling Connect:Direct for i5/OS 3.6, 3.7 and 3.8

Remediation/Fixes

None

Workarounds and Mitigations

Sign on as the Connect:Direct Administrator and use the SPADMIN command to remove SSL protocol from any Secure+ definitions, use TLS instead. The same would need to occur on your remote Connect:Direct servers.

To make sure SSL is never used, from a 5250 command line:

WRKSYSVAL SYSVAL(QSSL)*

Note: You must have *IOSYSCFG, *ALLOBJ, and *SECADM special authorities to change this system value.

When managing the list of supported SSL protocols:

• Enter 5 to display QSSLPCL: This will display one of two things:
  1. *OPSYS: Which indicates the default protocols for the OS release are supported. To see what those defaults protocols actually are, reference the IBM Knowledge center for the appropriate OS release.
  2. A manually defined list of the SSL protocols currently supported by the system

• Enter 2 to edit QSSLPCL: *OPSYS is the default value. To add or remove an SSL protocol, the *OPSYS value must be removed and replaced with a complete list of all the SSL protocols you want to support. To see what the defaults protocols actually are and the list of protocols available, reference the IBM Knowledge Center for the appropriate OS release.**Note: **If an error is reported when attempting to modify the protocol list indicating that the QSSLCSL system value must be updated first, it means that the cipher specifications needed to support the protocols aren’t present. They either have to be added manually or QSSLCSLCTL set to *OPSYS, so they can be added for you.

IBM recommends that you review your entire environment to identify areas that enable the SSLv3 protocol and take appropriate mitigation and remediation actions. The most immediate mitigation action that can be taken is disabling SSLv3.