Security Bulletin: Vulnerabilities in OpenSSL affect the Cordova tools in Rational Application Developer affecting Rational Developer for i and Rational Developer for AIX and Linux (CVE-2016-0701, CVE-2015-3197)

Summary

Portions of IBM Rational Application Developer for WebSphere Software are shipped as a component of Rational Developer for i (RPG and COBOL + Modernization Tools, Java and EGL editions), and Rational Developer for AIX and Linux.
OpenSSL vulnerabilities were disclosed on January 28, 2016 by the OpenSSL Project. OpenSSL is used by IBM Rational Application Developer for WebSphere Software. IBM Rational Application Developer for WebSphere Software has addressed the applicable CVEs.

Vulnerability Details

CVEID: CVE-2016-0701**
DESCRIPTION:** OpenSSL could allow a remote attacker to conduct man-in-the-middle attacks, caused by the use of weak Diffie-Hellman parameters based on unsafe primes that are generated and stored in X9.42-style parameter files. By performing multiple handshakes using the same private DH exponent, an attacker could exploit this vulnerability to conduct man-in-the-middle attacks.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/110234 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

CVEID: CVE-2015-3197**
DESCRIPTION:** OpenSSL could allow a remote attacker to conduct man-in-the-middle attacks, caused by an error related to the negotiation of disabled SSLv2 ciphers by malicious SSL/TLS clients. An attacker could exploit this vulnerability to conduct man-in-the-middle attacks.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/110235 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

Affected Products and Versions

Affected Product and Version(s)

| Product and Version shipped as a component
—|—
IBM Rational Developer for i v9.1, v9.1.1, v9.1.1.1, v9.5, v9.5.0.1, 9.5.0.2 RPG and COBOL + Modernization Tools, Java Edition| Rational Application Developer 9.1, 9.1.1, 9.5
IBM Rational Developer for i v9.1, v9.1.1 and v9.1.1.1, v9.5, v9.5.0.1, 9.5.0.2 RPG and COBOL + Modernization Tools, EGL Edition| Rational Application Developer 9.1, 9.1.1, 9.5
IBM Rational Developer for AIX and Linux v9.1, v9.1.1, v9.1.1.1 and v9.1.1.2, AIX COBOL Edition| Rational Application Developer 9.1, 9.1.1
IBM Rational Developer for AIX and Linux v9.1, v9.1.1, v9.1.1.1 and v9.1.1.2, C/C++ Edition| Rational Application Developer 9.1, 9.1.1

Remediation/Fixes

Review the Remediation/Fixes section of Security Bulletin: Vulnerabilities in OpenSSL affect Rational Application Developer for WebSphere Software (CVE-2016-0701, CVE-2015-3197) for instructions on obtaining the fix for this issue.