Security Bulletin: Vulnerabilities in OpenSSL affect Rational ClearQuest (CVE-2015-0209, CVE-2015-0286, CVE-2015-0288, CVE-2015-0293)

Summary

OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. OpenSSL is used by cqperl and ratlperl for SSL communications. Rational ClearQuest has addressed the applicable CVEs.

Vulnerability Details

CVEID: CVE-2015-0209**
DESCRIPTION:** OpenSSL could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free error in the d2i_ECPrivateKey or EVP_PKCS82PKEY function. An attacker could exploit this vulnerability using a malformed Elliptic Curve (EC) private-key file to corrupt memory and execute arbitrary code on the system and cause a denial of service.
CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101674 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVEID: CVE-2015-0286**
DESCRIPTION:** OpenSSL is vulnerable to a denial of service, caused by an error in the ASN1_TYPE_cmp function when attempting to compare ASN.1 boolean types. An attacker could exploit this vulnerability to crash any certificate verification operation and cause a denial of service.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101666 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2015-0288**
DESCRIPTION:** OpenSSL is vulnerable to a denial of service, caused by an error in the X509_to_X509_REQ function. An attacker could exploit this vulnerability to trigger a NULL pointer dereference.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101675 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2015-0293**
DESCRIPTION:** OpenSSL is vulnerable to a denial of service. By sending a specially-crafted SSLv2 CLIENT-MASTER-KEY message, a remote attacker could exploit this vulnerability to trigger an assertion.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101671 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Affected Products and Versions

IBM Rational ClearQuest versions:

Version

|

Status

—|—

8.0.1 through 8.0.1.7

|

Affected

8.0 through 8.0.0.14

|

Affected

7.1.2.x through 7.1.2.17

|

Affected

Not all deployments of Rational ClearQuest use OpenSSL in a way that is affected by these vulnerabilities.

You are vulnerable if your use of Rational ClearQuest includes any of these configurations:

1. You use SSL connections in perl scripts run by ratlperl or cqperl, or by ClearQuest hooks. In this situation, you should review all the fixes provided by the OpenSSL project to see which ones apply to your use of OpenSSL. See the references link below.
2. You integrate with ClearCase. See Security Bulletin: Vulnerabilities in OpenSSL affect Rational ClearCase (CVE-2015-0209, CVE-2015-0286, CVE-2015-0288, CVE-2015-0293)

Remediation/Fixes

The fix is to install a ClearQuest Fix Pack which includes OpenSSL 1.0.1M. (This fix supersedes the fix that includes OpenSSL 1.0.1L, announced in bulletin 1699040.)

Upgrade ClearQuest

Affected Versions

|

Fix Pack containing the fix

—|—

8.0.1.x

| Install Rational ClearQuest Fix Pack 8 (8.0.1.8)

8.0.0.x

| Install Rational ClearQuest Fix Pack 15 (8.0.0.15)

7.1.2.x

| Customers with extended support contracts should install Rational ClearQuest Fix Pack 18 (7.1.2.18)

You should verify applying this fix does not cause any compatibility issues.

Workarounds and Mitigations

Disable any script that uses SSL and runs in ratlperl, cqperl or ClearQuest hooks until you apply the fixes listed above.