Security Bulletin: OpenSSL vulnerability in IBM Storwize V7000 Unified (CVE-2014-0224)

Summary

Security vulnerability in OpenSSL.

Vulnerability Details

**CVEID:**CVE-2014-0224

DESCRIPTION: SSL/TLS MITM vulnerability

An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can decrypt and modify traffic from the attacked client and server.

The attack can only be performed between a vulnerable client and server. OpenSSL clients are vulnerable in all versions of OpenSSL. Storwize V7000 Unified systems use OpenSSL server functionality and some versions are vulnerable (see below).

CVE-2014-0224
CVSS Base Score: 5.8
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/93586 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N)

Affected Products and Versions

IBM Storwize V7000 Unified

All versions are affected when running code releases 1.3 and 1.4 except for versions 1.4.3.3 and above.

Remediation/Fixes

For IBM Storwize V7000 Unified install the following code levels or higher:
1.5.0.0
1.4.3.3

Latest Storwize V7000 Unified Software

Workarounds and Mitigations

Ensure that all users who have access to the system are authenticated by another security system such as a firewall