Lucene search

K
ibmIBM512128914F0E940733AA8FCEADE82B253B89B441D03FC6E96899CF50C10F8555
HistoryAug 03, 2018 - 4:23 a.m.

Security Bulletin: Vulnerabilities in GSKit affect Host On-Demand (CVE-2015-0138)

2018-08-0304:23:43
www.ibm.com
19

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

Summary

GSKit is an IBM component that is used by Host On-Demand.The GSKit that is shipped with Host On-Demand contains multiple security vulnerabilities including the “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. Host On-Demand has addressed the applicable CVEs.

Vulnerability Details

CVEID: CVE-2015-0138 DESCRIPTION: A vulnerability in various IBM SSL/TLS implementations could allow a remote attacker to downgrade the security of certain SSL/TLS connections. An IBM SSL/TLS client implementation could accept the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. This could allow a remote attacker using man-in-the-middle techniques to facilitate brute-force decryption of TLS/SSL traffic between vulnerable clients and servers.

This vulnerability is also known as the FREAK attack.

CVSS Base Score: 4.3
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/#/vulnerabilities/100691 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Affected Products and Versions

Host On Demand 11.0.12 and earlier

Remediation/Fixes

Product

| VRMF| Remediation/First Fix
—|—|—
Host On-Demand| 11.0.13| To be announced

For IBM Rational Host On-Demand 11.0.12 and before, IBM recommends upgrading to IBM Rational Host On-Demand 11.0.13, scheduled to be released on 23rd March 2015.

Workarounds and Mitigations

None

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

Related for 512128914F0E940733AA8FCEADE82B253B89B441D03FC6E96899CF50C10F8555