Security Bulletin: Vulnerability in Mozilla Network Security Services (NSS) affects the IBM FlashSystem model V840

2018-06-18T00:36:15
ID C5BC6A8A20C5E595B6773CB368EFD7BC771C03C2AD355C52EF7D05090227DAB5
Type ibm
Reporter IBM
Modified 2018-06-18T00:36:15

Description

Summary

There is a vulnerability in Mozilla NSS to which the IBM® FlashSystem™ V840 is susceptible. An exploit of this vulnerability (CVE-2016-9074) could make the system susceptible to timing side-channel attacks which could be leveraged to allow launch of further attacks on the system

Vulnerability Details

CVEID: CVE-2016-9074
DESCRIPTION: Mozilla Network Security Services (NSS), as used in Mozilla Firefox, could provide weaker than expected security, caused by an insufficient mitigation of timing side-channel attacks. An attacker could exploit this vulnerability to gain launch further attacks on the system.
CVSS Base Score: 6.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/118942 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Affected Products and Versions

Storage Node machine type and models (MTMs) affected: 9840-AE1 and 9843-AE1
Controller Node MTMs affected: 9846-AC0, 9848-AC0, 9846-AC1, and 9848-AC1

Supported storage node code versions which are affected
· VRMFs prior to 1.3.0.7
· VRMFs prior to 1.4.5.0

Supported controller node code versions which are affected
· VRMFs prior to 7.5.0.10 or 7.5.1.5
· VRMFs prior to 7.6.1.7
· VRMFs prior to 7.7.1.6
· VRMFs prior to 7.8.0.2 or 7.8.1.0

Remediation/Fixes

V840 MTMs

| VRMF| APAR| Remediation/First Fix
---|---|---|---
Storage nodes:
9846-AE1 &
9848-AE1

Controller nodes:
9846-AC0,
9846-AC1,
9848-AC0, &
9848-AC1| _Code fixes are available, the minimum remediating VRMF by code stream:

Storage Node VRMF
1.4 stream: 1.4.5.0
_1.3 stream: 1.3.0.7

Controller Node VRMF
7.8 stream: 7.8.0.2 or 7.8.1.0
7.7 stream: 7.7.1.6
7.6 stream: 7.6.1.7
7.5 stream: 7.5.0.10 or 7.5.1.5| _ __N/A_| FlashSystem V840 fixes for storage and controller node are available @ IBM’s Fix Central

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Complete CVSS v3 Guide
On-line Calculator v3

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Acknowledgement

None

Change History

22 December 2017 Original Version Published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

[{"Product":{"code":"ST2HTZ","label":"IBM FlashSystem V840"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Component":"Security Bulletin","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"Version Independent","Edition":"","Line of Business":{"code":"","label":""}}]