7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
A vulnerability has been identified in the GSKit component utilized by Tivoli Access Manager for e-business (TAM). A specially crafted SSL message can cause the TAM server component using GSKit to crash. Remediation for the issue consists of upgrading affected GSKit following the instructions at the end of this bulletin.
CVE ID:
CVE-2013-6329
DESCRIPTION:
TAM uses GSKit for SSL connections. The GSKit implementation is vulnerable to an attack from a specially crafted SSL message. Were an attacker to construct and send such an SSL request, they could cause the TAM server process to crash. The attack does not require local network access nor does it require authentication or specialized knowledge and techniques are required. An exploit would not impact the confidentiality of information or the integrity of data, however accessibility of the system can be compromised.
CVSS:
CVSS Base Score: 7.8
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/88939>
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:C)
All supported Tivoli Access Manager for e-business versions are affected.
The following versions of GSKit contain the fix for this issue:
Β· GSKit version 7.0.4.47 or higher
Β· GSKit version 8.0.50.13 or higher
How to obtain the patched GSKit versions:
1. Download the FP or iFix listed in the Vendor Fixes table below that matches your installed Tivoli Access Manager or IBM Security Access Manager version.
2. Follow the instructions in the README to obtain and apply the appropriate GSKit fix for your product version.
Vendor Fix(es):
TAM for e-business/ISAM Version | GSKit Version | Interim Fix |
---|---|---|
TAM**_ for e-business _**6.0 | GSKit v7 | 6.0.0.31-ISS-TAM-IF0031 |
TAM**_ for e-business _**6.1 | GSKit v7 | 6.1.0-TIV-TAM-IF0012 |
TAM**_ for e-business _**6.1.1 | GSKit v7 | 6.1.1-ISS-TAM-FP0008 |
TAM**_ for e-businessISAM WGA _**7.0 | GSKit v8 | 7.0.0-ISS-WGA-FP0002 |
None