Lucene search

K
ibmIBM5B9FE3466C6709549936B7AF9F0C0D4DCFCB7C692D0EEFEE7E0A64D8C6798193
HistoryMay 23, 2022 - 7:47 p.m.

Security Bulletin: IBM Security Verify Adapters are vulnerable to denial of service and bypass security restrictions due to OpenSSL (CVE-2021-3449, CVE-2021-3450)

2022-05-2319:47:54
www.ibm.com
34

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.003 Low

EPSS

Percentile

70.6%

Summary

OpenSSL is used by the IBM Security Verify Adapters as part of its SSL communication. IBM Security Verify Adapters are vulnerable to denial of service (CVE-2021-3449) and could allow a remote attacker to bypass security restrictions (CVE-2021-3450) The fix includes OpenSSL version 1.1.1k.

Vulnerability Details

CVEID:CVE-2021-3449
**DESCRIPTION:**OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference in signature_algorithms processing. By sending a specially crafted renegotiation ClientHello message from a client, a remote attacker could exploit this vulnerability to cause the TLS server to crash.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/198752 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2021-3450
**DESCRIPTION:**OpenSSL could allow a remote attacker to bypass security restrictions, caused by a missing check in the validation logic of X.509 certificate chains by the X509_V_FLAG_X509_STRICT flag. By using any valid certificate or certificate chain to sign a specially crafted certificate, an attacker could bypass the check that non-CA certificates must not be able to issue other certificates and override the default purpose.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/198754 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H)

Affected Products and Versions

Adapter Name

|

Version

—|—
IBM Security Verify Adapter for Lotus Notes | 7.1.16, 6.0.16
IBM Security Verify Adapter for Microsoft SQL Server | 7.1.18, 6.0.18
IBM Security Verify Adapter for Windows Active Directory | 10.0.1
IBM Security Verify Adapter for Windows Local Accounts | 7.1.20, 6.0.20

Remediation/Fixes

IBM encourages customers to update their systems promptly.

Adapter Name

|

Version

—|—
IBM Security Verify Adapter for Lotus Notes | 10.0.1 or higher
IBM Security Verify Adapter for Microsoft SQL Server | 10.0.1 or higher
IBM Security Verify Adapter for Windows Active Directory | 10.0.2 or higher
IBM Security Verify Adapter for Windows Local Accounts | 10.0.1 or higher

To download the IBM Security Verify Adapter, sign into IBM Passport Advantage Online (PAO) website. Note, you must be an authorized user from your company to sign in.
Enter the adapter name text string for search by Product name.

Workarounds and Mitigations

None

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.003 Low

EPSS

Percentile

70.6%

Related for 5B9FE3466C6709549936B7AF9F0C0D4DCFCB7C692D0EEFEE7E0A64D8C6798193