Security Bulletin: Vulnerability in OpenSSL affects AIX (CVE-2018-0737)

Summary

There is a vulnerability in OpenSSL used by AIX.

Vulnerability Details

CVEID: CVE-2018-0737 DESCRIPTION: The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key.
CVSS Base Score: 3.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/141679&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

AIX 5.3, 6.1, 7.1, 7.2
VIOS 2.2.x

The following fileset levels are vulnerable:

key_fileset = osrcaix

Fileset Lower Level Upper Level KEY
------------------------------------------------------
openssl.base 1.0.2.500 1.0.2.1300 key_w_fs
openssl.base 20.13.102.1000 20.13.102.1300 key_w_fs

Note:
A. 0.9.8, 1.0.1 OpenSSL versions are out-of-support. Customers are advised to upgrade to currently supported OpenSSL 1.0.2 version.
B. Latest level of OpenSSL fileset is available from the web download site:

https://www14.software.ibm.com/webapp/iwm/web/reg/download.do?source=ai…

To find out whether the affected filesets are installed on your systems, refer to the lslpp command found in the AIX user’s guide.

Example: lslpp -L | grep -i openssl.base

Remediation/Fixes

FIXES

A fix is available, and it can be downloaded from:
<https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=aixbp&gt;

To extract the fixes from the tar file:

For Openssl 1.0.2 version -
zcat openssl-1.0.2.1500.tar.Z | tar xvf -

For 1.0.2 FIPS capable openssl version -
zcat openssl-20.13.102.1500.tar.Z | tar xvf -

IMPORTANT: If possible, it is recommended that a mksysb backup of the system be created. Verify it is both bootable and readable before proceeding.

Note that all the previously reported security vulnerability fixes are also included in above mentioned fileset level. Please refer to the readme file (provided along with the fileset) for the complete list of vulnerabilities fixed.

To preview the fix installation:
installp -apYd . openssl

To install the fix package:
installp -aXYd . openssl

openssl dgst -sha1 -verify [pubkey_file] -signature [advisory_file].sig [advisory_file]
openssl dgst -sha1 -verify [pubkey_file] -signature [ifix_file].sig [ifix_file]

Published advisory OpenSSL signature file location:
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory27.asc…
https://aix.software.ibm.com/aix/efixes/security/openssl_advisory27.asc…
ftp://aix.software.ibm.com/aix/efixes/security/openssl_advisory27.asc.s…

Workarounds and Mitigations

None.