Security Bulletin: OpenSSL vulnerabilities affect IBM Rational Team Concert (CVE-2016-8610)

Summary

OpenSSL vulnerability was disclosed by the OpenSSL Project. OpenSSL is used by Rational BuildForge Agent shipped with IBM Rational Team Concert. Rational BuildForge has addressed the applicable CVEs.

Vulnerability Details

CVEID: CVE-2016-8610**
DESCRIPTION:** SSL/TLS protocol is vulnerable to a denial of service, caused by an error when processing ALERT packets during a SSL handshake. By sending specially-crafted packets, a remote attacker could exploit this vulnerability to cause the application to stop responding.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/118296 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Rational Collaborative Lifecycle Management 4.0 - 6.0.4

Rational Team Concert 4.0 - 4.0.7
Rational Team Concert 5.0 - 5.0.2
Rational Team Concert 6.0 - 6.0.4

Remediation/Fixes

Upgrade your Rational Build Forge Agent to version 8.0.0.4 iFix2 from:

BuildForge 8.0.0.4 iFix2

Workarounds and Mitigations

None