Lucene search

K
ibmIBM83FA7A19C477B3CD7F62A6093A5E7FBA59DD3F7E01AC5792ED206BB8B735873D
HistoryDec 18, 2019 - 2:26 p.m.

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM i (CVE-2015-4000)

2019-12-1814:26:38
www.ibm.com
18

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

Summary

The Logjam Attack on TLS connections using the Diffie-Hellman (DH) key exchange protocol affects IBM i.

Vulnerability Details

CVEID: CVE-2015-4000**
DESCRIPTION:** The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey a DHE_EXPORT ciphersuite choice. An attacker could exploit this vulnerability using man-in-the-middle techniques to force a downgrade to 512-bit export-grade cipher. Successful exploitation could allow an attacker to recover the session key as well as modify the contents of the traffic. This vulnerability is commonly referred to as “Logjam”.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/103294 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Affected Products and Versions

Releases V5R3, V5R4, 6.1, 7.1 and 7.2 of IBM i are affected.

Remediation/Fixes

The issue can be fixed by applying a PTF to the IBM i Operating System.

Releases 6.1, 7.1 and 7.2 of IBM i are supported and will be fixed. Releases V5R3 and V5R4 are unsupported and will not be fixed.

The IBM i OS PTF numbers are:

Release 6.1 – SI57527 Release 7.1 – SI57473 Release 7.2 – SI57468

PTFs for IBM i Java

Java60 ----------------------- 6.1 and 7.1

32bit: SI57243 64bit: SI57246

7.2 32bit: SI57244 64bit: SI57245

Java626 ----------------------- 6.1 and 7.1 32bit: SI57250 64bit: SI57247

7.2 32bit: SI57248 64bit: SI57249

Java70
----------------------- 6.1 and 7.1 32bit: SI57278 SI57277 64bit: SI57279 SI57280

7.2 32bit: SI57281 64bit: SI57282

Java 71 ----------------------- 7.1 32bit: SI57291 64bit: SI57293

7.2 32bit: SI57292 64bit: SI57294

Java80 ----------------------- 7.1 32bit: SI57296 64bit: SI57298

7.2 32bit: SI57297 64bit: SI57299

For CVE-2015-4000: As the length of the server key size are increased, the amount of CPU required for full TLS/SSL handshake can significantly increase. Please carefully test and assess the impact to your CPU requirements to ensure sufficient CPU resources, otherwise the system availability may be impacted.

For CVE-2015-4000: You should verify applying this configuration change does not cause any compatibility issues. If you change the default setting after applying the fix, you will expose yourself to the attack described above. IBM recommends that you review your entire environment to identify other areas where you have enabled the Diffie-Hellman key-exchange protocol used in TLS and take appropriate mitigation and remediation actions.

_Important note: _IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products.

Workarounds and Mitigations

None known

CPENameOperatorVersion
ibm ieq7.1.0

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

Related for 83FA7A19C477B3CD7F62A6093A5E7FBA59DD3F7E01AC5792ED206BB8B735873D