Security Bulletin: Vulnerability in IBM Java Runtime and GSKit affects IBM Tivoli Monitoring for Tivoli Storage Manager (CVE-2015-0138)

Summary

IBM Tivoli Monitoring for Tivoli Storage Manager packages IBM Tivoli Monitoring (ITM) as one of its components.

The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability affects IBM® Runtime Environment Java™ Technology Edition that is used by ITM.

GSKit is an IBM component that is used by IBM Tivoli Monitoring. The GSKit that is shipped with IBM Tivoli Monitoring contains a security vulnerability for the “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. ITM has addressed the CVE.

Vulnerability Details

CVEID: CVE-2015-0138**
DESCRIPTION:** A vulnerability in various IBM SSL/TLS implementations could allow a remote attacker to downgrade the security of certain SSL/TLS connections. An IBM SSL/TLS client implementation could accept the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. This could allow a remote attacker using man-in-the-middle techniques to facilitate brute-force decryption of TLS/SSL traffic between vulnerable clients and servers.
This vulnerability is also known as the FREAK attack.

CVSS Base Score: 4.3
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/#/vulnerabilities/100691 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Affected Products and Versions

The following components of IBM Tivoli Monitoring for Tivoli Storage Manager are affected by this vulnerability.

• IBM Tivoli Monitoring for Tivoli Storage Manager version 6.1 - 7.1

Remediation/Fixes

The solution provided is for IBM Tivoli Monitoring for Tivoli Storage Manager versions 6.3 and 7.1.

Table: Upgrading IBM Tivoli Monitoring

6.2.2-TIV-ITM-FP0009

7.1.x|

6.3.3-TIV-ITM-FP0004

Table: Security Fixes for IBM Tivoli Monitoring

NOTE:

Extended support customers using IBM Tivoli Monitoring versions 6.1 or 6.2 for Tivoli Storage Manager should contact IBM support.

Follow the 6.X.X-TIV-ITM_JRE_CANDLEHOME_XX.XX.XX.XX.README instructions to install the ITM IFIX. Where XX.XX.XX.XX matches the IFIX level download.

Workarounds and Mitigations

None