OpenSSL vulnerabilities were disclosed on May 3, 2016 by the OpenSSL Project. OpenSSL is used by IBM b-type SAN switches and directors has addressed the applicable CVE.
CVEID: CVE-2016-2108**
DESCRIPTION:** OpenSSL could allow a remote attacker to execute arbitrary code on the system, caused by a buffer underflow when deserializing untrusted ASN.1 structures and later reserializes them. An attacker could exploit this vulnerability to corrupt memory and trigger an out-of-bounds write and execute arbitrary code on the system.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112853 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
FOS versions prior to 7.4.2
FOS versions prior to 8.1.0c
IBM Network Advisor versions prior to 14.0.2
Product
| VRMF| Fix
—|—|—
FOS| 7.4.2| __http://www-01.ibm.com/support/docview.wss?uid=ssg1S1003855__
_FOS _| 8.1.0c| _http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009577_
IBM Network Advisor| 14.0.2| __http://www-01.ibm.com/support/docview.wss?uid=ssg1S7005391__
None