Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by vulnerability in OpenSSL (CVE-2012-4929)

Summary

The following vulnerability in OpenSSL has been addressed by IBM Integrated Management Module II (IMM2).

Vulnerability Details

CVEID:CVE-2012-4929
**DESCRIPTION:**The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome,Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a “CRIME” attack.
CVSS Base score: 2.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/78807 for the current score.
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Firmware fix versions are available on Fix Central: <http://www.ibm.com/support/fixcentral/&gt;

IBM Integrated Management Module II (IMM2) for System x and Flex

(ibm_fw_imm2_1aoo92a-7.60_anyos_noarch)

| 1AOO92A-7.60

IBM Integrated Management Module II (IMM2) for BladeCenter

(ibm_fw_imm2_1aoo92a-7.60-bc_anyos_noarch)

| 1AOO92A-7.60-bc

Workarounds and Mitigations

None