Security Bulletin: Vulnerability in RC4 stream cipher affects z/TPF (CVE-2015-2808)

Summary

The RC4 “Bar Mitzvah Attack” for Secure Sockets Layer (SSL) and Transport Layer Security (TLS) affects z/TPF.

Vulnerability Details

CVEID: CVE-2015-2808

DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this vulnerability to remotely expose account credentials without requiring an active man-in-the-middle session. Successful exploitation could allow an attacker to retrieve credit card data or other sensitive information. This vulnerability is commonly referred to as “Bar Mitzvah Attack”.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101851 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

Affected Products and Versions

z/TPF Enterprise Edition Version 1.1.11 and earlier

Remediation/Fixes

Product

| VRMF|APAR|Remediation/First Fix
—|—|—|—
z/TPF| 1.1.11 and earlier| None| Do not use the RC4 algorithm in SSL sessions. See Workarounds and Mitigations.

Workarounds and Mitigations

Disable the RC4 encryption algorithm from the OpenSSL library for z/TPF. To disable the RC4 encryption algorithm, complete the following steps:

1. Ensure that existing SSL applications are not set up to use the RC4 encryption alogorithm. If they are, change the applications to use a more secure algorithm, such as AES-128.
2. Add the OPENSSL_NO_RC4 compiler option to the cryp.mak and cssl.mak files:

• In the cryp.mak file, add the following statement:
  CFLAGS_CRYP += -DOPENSSL_NO_RC4
• In the cssl.mak file, add the following statement:
  CFLAGS_CSSL += -DOPENSSL_NO_RC4
• Remove or comment out the following source segments in the cryp.mak file:
  #C_SRC += rc4_enc.c #C_SRC += rc4_skey.c
• Build the CRYP and CSSL shared objects by using **maketpf** with the force (-f) option
• Load the CRYP and CSSL shared objects to the z/TPF system again.
• Recyle the shared SSL daemons (if defined) and restart all SSL applications.