Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM FlashSystem model 840 (CVE-2015-7575)

Summary

The MD5 “SLOTH” vulnerability on TLS 1.2 affects IBM® FlashSystem™ 840.

Vulnerability Details

CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message during a TLS handshake. An attacker could exploit this vulnerability using man-in-the-middle techniques to impersonate a TLS server and obtain credentials.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/109415 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)

Affected Products and Versions

FlashSystem 840 systems are affected when running code levels before 1.1.3.8. Code levels starting 1.2, 1.3, and 1.4 are not affected. MTMs affected include 9840-AE1 and 9843-AE1.

Remediation/Fixes

If the code level your machine is running is affected, IBM recommends that you fix this vulnerability by upgrading the 840 to one of the following code levels or higher:

_Fixed code VRMF .
1.4 stream: 1.4.0.7 (or later)
1.3 stream: 1.3.0.2 (or later)
1.2 stream: 1.2.1.7 (or later)
1.1 stream: 1.1.3.8 (or later)| _ _N/A| No workarounds or mitigations, other than applying this code fix, are known for this vulnerability

** **FlashSystem 840 fixes****are available @ IBM’s Fix Central

Workarounds and Mitigations

None