Security Bulletin: Vulnerability in SSLv3 affects Rational DOORS Web Access (CVE-2014-3566)

Summary

SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 can be enabled in IBM Rational DOORS Web Access.

Vulnerability Details

| Subscribe to My Notifications to be notified of important product support alerts like this.

• Follow this link for more information (requires login with your IBM ID)
  —|—

CVE ID: CVE-2014-3566** **
Description: Product could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and access the plaintext of encrypted connections.

CVSS Base Score: 4.3 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/97013&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Affected Products and Versions

Rational DOORS Web Access version 9.6.0.x, 9.5.2.x, 9.5.1.x, 9.5.0.x, 1.5.0.x, 1.4.0.x.

Remediation/Fixes

None

Workarounds and Mitigations

IBM recommends that you review your entire environment to identify areas that enable the SSLv3 protocol and take appropriate mitigation and remediation actions. The most immediate mitigation action that can be taken is disabling SSLv3.

To avoid this vulnerability, configure the Apache Tomcat server.xml file in your Rational DOORS Web Access installation to disable SSLv3 and instead use TLS v1.2 or v1.1. Note that TLS v1.2 is more secure, but not all servers, clients, and browsers support this protocol. Do not use TLSv1.0.

Procedure:

1. To access the configuration files for Rational DOORS Web Access for SSL or TLS, review the help topic Configuring Rational DOORS Web Access to use SSL or TLS** **for more details.

2. In the SSL JSSE HTTP Connector section of the server.xml file, set the following values.**

****For Rational DOORS Web Access versions 9.5.2.x, 9.5.1.x, 9.5.0.x, 1.5.0.x, 1.4.0.x (prior to Tomcat 6.0.39): ``<Connector port="8443" protocol="HTTP/1.1" maxThreads="150" clientAuth="false" SSLEnabled="true" scheme="https" secure="true" ``**sslProtocol="TLS"**`` ``**protocols="TLSv1.2,TLSv1.1"**``/>``** ** ****For Rational DOORS Web Access versions 9.6.0.x (Tomcat 6.0.39 and later):`
<Connector port="8443" protocol="HTTP/1.1" maxThreads="150" clientAuth="false" SSLEnabled="true" scheme="https" secure="true" sslProtocol=“TLS” sslEnabledProtocols=“TLSv1.2,TLSv1.1”/>

3. If you are using APR, use the following values:

<Connector... maxThreads="200" enableLookups="true" disableUploadTimeout="true" acceptCount="100" scheme="https" secure="true" SSLEnabled="true" SSLProtocol=“TLSv1” SSLCertificateFile="${catalina.base}/conf/localhost.crt" SSLCertificateKeyFile="${catalina.base}/conf/localhost.key" />``

**`
4. Save and close the server.xml file.

5. Restart the Rational DOORS Web Access server.

You can test the SSL/TLS version configuration in Tomcat by running the following commands in openssl:
openssl s_client -connect testhost:port -ssl3

• Failsif SSLv3 is disabled.

openssl s_client -connect testhost:port -tls1

• Returns a certificate if TLSv1 is enabled.

openssl s_client -connect testhost:port -tls1_1

• Returns a certificate if TLSv1.1 is enabled.

openssl s_client -connect testhost:port -tls1_2

• Returns a certificate if TLSv1.2 is enabled.