Security Bulletin: IBM X Series hardware IMMv1, IMMv2 remote management ports as used by IBM QRadar SIEM appliances are affected by the following OpenSSL vulnerabilities: (CVE-2014-0224)

Summary

Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project.

Vulnerability Details

CVE-ID:CVE-2014-0224

**DESCRIPTION:**OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients and servers. A remote attacker could exploit this vulnerability using a specially-crafted handshake to conduct man-in-the-middle attacks to decrypt and modify traffic.

CVSS Base Score: 5.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/93586 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N)

Affected Products and Versions

IBM QRadar Security Information and Event Manager (SIEM) appliances (versions 7.1 and 7.2) installed on the following hardware:

• IBM X3650 M4 BD (5466) Servers running IMMv2
• IBM X3550 M4 (7914) Servers running IMMv2
• IBM X3550 M3 (7944) Servers running IMMv1
• IBM X3630 M3 (7377) Server running IMMv1

Remediation/Fixes

* **IBM X3650 M4 BD (5466) -**Update to version 3.76 of the IMMv2 firmware**:   **[Integrated Management Module 2 (IMM2) Update](<http://www-933.ibm.com/support/fixcentral/systemx/selectFixes?parent=System%2Bx3650%2BM4%2BBD&product=ibm/systemx/5466&&platform=RHEL+6&function=all>)**\-**ibm_fw_imm2_1aoo56q-3.76_anyos_noarch


* **IBM X3550 M4 (7914) -**Update to version 4.31 of the IMMv2 firmware: [  

Integrated Management Module 2 (IMM2) Update](<http://www-933.ibm.com/support/fixcentral/systemx/selectFixes?parent=System%2Bx3550%2BM4&product=ibm/systemx/7914&&platform=RHEL+6&function=all&gt;) - ibm_fw_imm2_1aoo58t-4.31_anyos_noarch

* **IBM X3550 M3 (7944) -**Update to version 1.44 of the IMMv1 firmware**:   **[Integrated Management Module Update](<http://www-933.ibm.com/support/fixcentral/systemx/selectFixes?parent=System%2Bx3550%2BM3&product=ibm/systemx/7944&&platform=RHEL+6&function=all>)**\-**ibm_fw_imm_yuoog6c-1.44_linux_32-64 


* **IBM X3630 M3 (7377) -**Update to version 1.44 of the IMMv1 firmware**:**[  

Integrated Management Module Update](<http://www-933.ibm.com/support/fixcentral/systemx/selectFixes?parent=System%2Bx3630%2BM3&product=ibm/systemx/7377&&platform=RHEL+6&function=all&gt;)**-**ibm_fw_imm_yuoog6c-1.44_linux_32-64

Workarounds and Mitigations

None