Security Bulletin: Vulnerability in SSLv3 affects Rational BuildForge (CVE-2014-3566)

Summary

SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSL_TLS is enabled by default in Build Forge in some pages.

Vulnerability Details

CVE ID: CVE-2014-3566** **
**Description:**IBM WebSphere Application could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and access the plaintext of encrypted connections.

CVSS Base Score: 4.3 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/97013&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Affected Products and Versions

IBM Rational Build Forge versions 7.1.1, 7.1.2, 7.1.3 and 8.0

Workarounds and Mitigations

You can change the configuration file by the following steps to disable the SSLv3.

**Note:**bfinstall is used below to represent the installation directory you have chosen to place Build Forge.

Procedure:

1. Open Build Forge console in browser

2. Go to Administration > Security-SSL

3. Change all the SSL_TLS/SSLv3/SSL to TLSv1 and save

4. Backup the bfclient.conf file

• By default the bfclient.conf is under \bfinstall on Windows

• By default the bfclient.conf is under /bfinstall/<platform> on Linux and UNIX

• Go to Administration > Security

• Click **Update Master BFClient.conf

Note: ** The bfclient.conf is used for Communication between Build Forge Service Layer and UI&Engine. It is also used by Build Forge API when you use the secure connection to Build Forge.

• Stop Build Forge

• Change the Apache ssl.conf config file

  • By default the ssl.conf is under *\bfinstall\Apache\Conf\ssl* on Windows
  • By default the ssl.conf is under /bfinstall/server/apache/conf/ssl/ on Linux and UNIX

• Update the following line for you version of Build Forge

  • For Build Forge 7.1.x:
    From: SSLProtocol -ALL +SSLv3 +TLSv1 To: `SSLProtocol -ALL +TLSv1

`

• For Build Forge 8.0.0.x:
  From: SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
  To: SSLProtocol -ALL +TLSv1 +TLSv1.1 +TLSv1.2

• Change the Tomcat server.conf config

  • By default the server.conf is under *\bfinstall\Apache\tomcat\conf* on Windows
  • By default the server.conf is under /bfinstall/server/tomcat/conf/ on Linux and UNIX

• Find the sslProtocol="SSL_TLS" line and change the SSL_TLS to TLS and save

Note: If Build Forge is installed with WebSphere Application Server, this step is not required

• Start Build Forge