Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM QRadar SIEM, and QRadar Incident Forensics (CVE-2015-7575)

Summary

The MD5 “SLOTH” vulnerability on TLS 1.2 affects IBM QRadar SIEM and QRadar Incident Forensics.

Vulnerability Details

CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message during a TLS handshake. An attacker could exploit this vulnerability using man-in-the-middle techniques to impersonate a TLS server and obtain credentials.

CVSS Base Score: 7.1

CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/109415 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)

Affected Products and Versions

· IBM QRadar SIEM and QRadar Incident Forensics 7.2.n

· IBM QRadar SIEM 7.1.n

Remediation/Fixes

· IBM QRadar/QRM/QVM/QRIF 7.2.6 Patch 2

· IBM QRadar 7.1 MR2 Patch 12 Interim Fix 1

Workarounds and Mitigations

None