Security Bulletin: Vulnerabilities in SSLv3 and GNU C library (glibc) affect multiple products shipped with Intelligent Cluster (CVE-2014-3566, CVE-2015-0235)

Summary

Information about security vulnerabilities affecting multiple products shipped as components of Intelligent Cluster has been published in security bulletins. The SSLv3 vulnerability (CVE-2014-3566) is referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. The GNU C library (glibc) vulnerability CVE-2014-3566 is referred to as GHOST.

Vulnerability Details

Summary

Information about security vulnerabilities affecting multiple products shipped as components of Intelligent Cluster has been published in security bulletins. The SSLv3 vulnerability (CVE-2014-3566) is referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. The GNU C library (glibc) vulnerability CVE-2014-3566 is referred to as GHOST.

Vulnerability Details

CVE-ID: CVE-2014-3566

Description: Multiple products could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via the POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and calculate the plaintext of secure connections.

CVSS Base Score: 4.3
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/97013&gt; for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVE-ID: CVE-2015-0235

Description: The gethostbyname functions of the GNU C Library (glibc) are vulnerable to a buffer overflow. By sending a specially crafted, but valid hostname argument, a remote attacker could overflow a buffer and execute arbitrary code on the system with the privileges of the targeted process or cause the process to crash. The impact of an attack depends on the implementation details of the targeted application or operating system. This issue is being referred to as the “Ghost” vulnerability.

CVSS Base Score: 7.6
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/100386&gt; for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C)

Please consult the security bulletins below for vulnerability details and information about fixes.

• IBM BladeCenter AMM
• IBM System x Integrated Management Module (IMM)
• IBM Flex System Integrated Management Module (IMM)
• IBM Flex System Chassis Management Module (CMM)
• IBM RackSwitch G8264
• IBM RackSwitch G8264T
• IBM Flex System FC5022 16Gb SAN Switch
• IBM Flex System FC3171 8Gb SAN Switch & Passthru
• IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch
• IBM GCM16-GCM32 KVM
• IBM SAN24B-4 Series Switches
• Brocade 8Gb SAN Switch Module for IBM BladeCenter
• Brocade 10Gb SAN Switch Module for IBM BladeCenter
• Brocade 4Gb SAN Switch Module for IBM BladeCenter
• IBM Converged Switch B32
• Intel Xeon Phi PCIe adapters
• DDN SFA12000 and SFA7700
• Cisco Nexus 5596UP (Ghost Poodle)
• Storwize V3700
• Intel True Scale 12000 Series Switches
• Juniper EX Series Switches
• Mellanox SX65XX, SX6036, SX1036 and SX6036G

Note: Not all supported products have a corresponding security bulletin.

Affected products and versions

Related Information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog
Intelligent Cluster Security Bulletin Readme

Change History
06 August 2015: Original Copy Published