Security Bulletin: OpenSSL security vulnerability issues on IBM SONAS (CVE-2013-4353, CVE-2013-6449, CVE-2013-6450)

Summary

For the three security issues with openssl that could result in denial of service, a fix is available for IBM SONAS

Vulnerability Details

CVEID:
CVE-2013-4353
CVE-2013-6449
CVE-2013-6450

DESCRIPTION:
OpenSSL is used in IBM SONAS for providing communication security by encrypting data being transmitted.

OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference when handling malicious S/MIME messages. By sending a specially-crafted TLS handshake, a remote attacker could exploit this vulnerability to cause a connecting client to crash.
CVE-2013-4353
CVSS Base Score: 5
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/90201&gt; for the current score

OpenSSL is vulnerable to a denial of service, caused by an error in the ssl_get_algorithm2 function. A remote attacker could exploit this vulnerability using specially-crafted traffic from a TLS 1.2 client to cause the daemon to crash.
CVE-2013-6449
CVSS Base Score: 4.3
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/90068&gt; for the current score

OpenSSL is vulnerable to a denial of service, caused by the failure to properly maintain data structures for digest and encryption contexts by the DTLS retransmission implementation. A remote attacker could exploit this vulnerability to cause the daemon to crash.
CVE-2013-6450
CVSS Base Score: 4.3
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/90069&gt; for the current score

Affected Products and Versions

IBM SONAS
The product is affected when running a code releases 1.3.0.0 to 1.4.3.2

Remediation/Fixes

A fix for these issues is in version 1.4.3.3 of IBM SONAS. Customers running an affected version of SONAS should upgrade to SONAS 1.4.3.3 or a later version, so that the fix gets applied.

Workarounds and Mitigations

Workaround(s) : None.

Mitigation(s) : A fix for these issues is in version 1.4.3.3 of IBM SONAS. Customers running an affected version of IBM SONAS should upgrade to 1.4.3.3 or a later version, so that the fix gets applied.