Security Bulletin: A security vulnerability in GSKit affects IBM Rational ClearQuest (CVE-2016-2183)

Summary

The GSKit that is shipped with IBM Rational ClearQuest contains a security vulnerability. IBM Rational ClearQuest has addressed the applicable CVE.

Vulnerability Details

CVEID: CVE-2016-2183 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a man-in-the-middle attack could exploit this vulnerability to recover the plaintext data and obtain sensitive information. This vulnerability is known as the SWEET32 Birthday attack.
CVSS Base Score: 3.7
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/116337 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Rational ClearQuest versions 7.1.2 through 7.1.2.19, 8.0 through 8.0.0.21, 8.0.1 through 8.0.1.14, and 9.0 through 9.0.0.4:

ClearQuest version

|

Status

—|—

9.0.1, 9.0.1.1

|

Not Affected

9.0 through 9.0.0.4

|

Affected

8.0.1 through 8.0.1.14

|

Affected

8.0 through 8.0.0.21

|

Affected

7.1.2 through 7.1.2.19 (all fix packs)

|

Affected

You are vulnerable if you configure Rational ClearQuest to use LDAP authentication with secure sockets connections.

Remediation/Fixes

The solution is to upgrade to a newer fix pack or release of ClearQuest.

Affected Versions

|

** Fixes**

—|—

9.0 through 9.0.0.4

| Install Rational ClearQuest Fix Pack 5 (9.0.0.5) for 9.0 or Rational ClearQuest release 9.0.1

8.0.1 through 8.0.1.14
8.0 through 8.0.0.21

| Install Rational ClearQuest Fix Pack 15 (8.0.1.15) for 8.0.1

7.1.2 through 7.1.2.19 (all fix packs)

| Customers should upgrade to a fixed, supported version/release of the product.

For 7.0, 7.1, 7.1.1 and earlier releases, IBM recommends upgrading to a fixed, supported version/release/platform of the product.

Note: Several TLS ciphers are vulnerable to CVE-2016-2183. These ciphers are disabled by default in ClearQuest for secure LDAP connections. Review the following technote for details:

Certain TLS 1.0/1.1 ciphers are now disabled by default for secure LDAP connections.

Workarounds and Mitigations

None