Security Bulletin: Vulnerabilities in OpenSSL affect IBM MessageSight (CVE-2014-3569, CVE-2015-0205)

Summary

OpenSSL vulnerabilities were disclosed by the OpenSSL Project. OpenSSL is used by IBM MessageSight. IBM MessageSight has addressed the applicable CVEs.

Vulnerability Details

CVEID: CVE-2014-3569
DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the failure to properly handle attempts to use unsupported protocols by the ssl23_get_client_hello function in s23_srvr.c. A remote attacker could exploit this vulnerability using an unexpected handshake to trigger a NULL pointer dereference and cause the daemon to crash.

CVSS Base Score: 5
CVSS Temporal Score: See<https://exchange.xforce.ibmcloud.com/vulnerabilities/99706&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2015-0205
DESCRIPTION: OpenSSL could allow a remote authenticated attacker to bypass security restrictions, caused by the acceptance of a DH certificate for client authentication without verification. An attacker could exploit this vulnerability to authenticate without the use of a private key.

CVSS Base Score: 2.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/99708&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:S/C:N/I:P/A:N)

Affected Products and Versions

IBM MessageSight V1.1 and V1.2

Remediation/Fixes

Product

| VRMF| APAR| Remediation / First Fix
—|—|—|—
IBM MessageSight| 1.1| IT07319| 1.1.0.1-IBM.IMA-IFIT07005
IBM MessageSight| 1.2| IT07319| 1.2.0.0-IBM-IMA-IFIT07005