Security Bulletin: Rational Application Developer for WebSphere Software in Cordova platform (CVE-2014-3513, CVE-2014-3567, CVE-2014-3568)

Summary

OpenSSL support for SSL 3.0 fallback protection + other 3 CVEs that affect the IBM SDK for Node.js used by the Cordova platform packaged with IBM Rational Application Developer for WebSphere Software.

Vulnerability Details

| Subscribe to My Notifications to be notified of important product support alerts like this.

• Follow this link for more information (requires login with your IBM ID)
  —|—

CVE ID: CVE-2014-3513 **Description: *OpenSSL is vulnerable to a denial of service, caused by a memory leak in the DTLS Secure Real-time Transport Protocol (SRTP) extension parsing code. By sending multiple specially-crafted handshake messages, an attacker could exploit this vulnerability to exhaust all available memory of an SSL/TLS or DTLS server.
CVSS Base Score: 5.0
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/97035&gt; for more information
CVSS Environmental Score: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVE-ID: CVE-2014-3567 Description: OpenSSL is vulnerable to a denial of service, caused by a memory leak when handling failed session ticket integrity checks. By sending an overly large number of invalid session tickets, an attacker could exploit this vulnerability to exhaust all available memory of an SSL/TLS or DTLS server.
CVSS Base Score: 5.0
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/97036&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector:** **(AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVE-ID: CVE-2014-3568 Description: OpenSSL could allow a remote attacker bypass security restrictions. When configured with “no-ssl3” as a build option, servers could accept and complete a SSL 3.0 handshake. An attacker could exploit this vulnerability to perform unauthorized actions.
CVSS Base Score: 2.6
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/97037&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:N/I:P/A:N)

Affected Products and Versions

IBM Rational Application Developer for WebSphere Software 9.1, 9.1.0.1 and 9.1.1

Remediation/Fixes

Update the IBM SDK for Node.js using by the Cordova platform in the product to address this vulnerability:

Installation instructions for applying the update to the Cordova platform in the product can be found here:

Upgrading the IBM SDK for Node.js used by Cordova

Workarounds and Mitigations

None