Security Bulletin: IBM Flex System Manager (FSM) and compatible IBM Systems Director agents are affected by vulnerabilities in OpenSSL (CVE-2013-4353, CVE-2013-6450, and CVE-2013-6449)

Summary

An interface on the IBM BladeCenter Advanced Management Module (AMM) may expose user account names and passwords that have been configured on that AMM.

Vulnerability Details

Abstract

The FSM and compatible agents contain a version of openssl that contained the 3 vulnerabilities listed above.

Content

Vulnerability Details:

CVE ID |Description |

Fix Target****Date

| Fix Version
—|—|—|—

CVE-2013-4353
CVSS Base Score: 5
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/90201&gt;
CVSS Environmental Score: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

| Invalid TLS handshake causes null pointer exception. | 05/09/14 |

V 1.2.0.1
V 1.2.1.1
V 1.3.0.2
V 1.3.1.1

CVE-2013-6450
CVSS Base Score: 4.3
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/90069&gt;
CVSS Environmental Score: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

| Remote attacker could cause openssl to crash due to improperly maintained data structures. | 05/09/14 |

V 1.2.0.1
V 1.2.1.1
V 1.3.0.2
V 1.3.1.1

CVE-2013-6449
CVSS Base Score: 4.3
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/90068&gt;
CVSS Environmental Score: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

| Attacker can crash openssl with a TLS1.2 exploit. | 05/09/14 |

V 1.2.0.1
V 1.2.1.1
V 1.3.0.2
V 1.3.1.1

Affected products and versions

From the FSM command line enter lsconfig –V to determine the level of FSM installed.

FSM

• Flex System Manager 1.2.0
• Flex System Manager 1.2.1
• Flex System Manager 1.3.0
• Flex System Manager 1.3.0.1
• Flex System Manager 1.3.1

Agents

• Agents for FSM 1.2.0 or 1.2.1
  • IBM Systems Director Platform Agent for Windows 6.3.2
  • IBM Systems Director Common Agent for Windows 6.3.2
  • IBM Systems Director Platform Agent for Linux 6.3.2
  • IBM Systems Director Common Agent for Linux 6.3.2
• Agents for FSM 1.3.0, 1.3.0.1,
  • IBM Systems Director Platform Agent for Windows 6.3.4
  • IBM Systems Director Common Agent for Windows 6.3.4
  • IBM Systems Director Platform Agent for Linux 6.3.4
  • IBM Systems Director Common Agent for Linux 6.3.4
• Agents for FSM 1.3.1
  • IBM Flex System Platform Agent for Windows 1.3.1
  • IBM Flex System Common Agent for Windows 1.3.1
  • IBM Flex System Platform Agent for Linux 1.3.1
  • IBM Flex System Common Agent for Linux 1.3.1

NON-AFFECTED PRODUCTS and VERSIONS

The following FSM levels are not vulnerable to these CVEs.

• Flex System Manager 1.1.0
• Flex System Manager 1.1.0.1
• Flex System Manager 1.1.1
• Flex System Manager 1.2.0.1
• Flex System Manager 1.2.1.1
• Flex System Manager 1.3.0.2
• Flex System Manager 1.3.1.1

Agent vulnerability is dependent on which platform the agent is installed. Details for each agent are included in the Remediation section below.

Remediation:

The remediation for these vulnerabilities is a subset of the action required for CVE-2014-0160 (also referred to as Heartbleed).

IBM recommends that you complete the remediation for CVE-2014-0160. When you have completed the CVE-2014-0160 remediation you will no longer be vulnerable to the exposures listed in this Security Bulletin.

The Security Bulletin for IBM Flex System Manager and the associated agents for CVE-2014-0160 is here.

If you have already completed the remediation for CVE-2014-0160, then no further action is required.

Workaround(s) & Mitigation(s):

None Known

References:

• Complete CVSS Guide
• On-line Calculator V2
• OpenSSL Project vulnerability website

Related Information:
IBM Secure Engineering Web Portal

Acknowledgement
None

Change History
7 May 2014_: Original Copy Published_

• The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Flash.

Note: According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an “industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response.” IBM PROVIDES THE CVSS SCORES “AS IS” WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.