Security Bulletin: Vulnerability in SSLv3 affects IBM InfoSphere Optim Performance Manager (CVE-2014-3566)

Summary

SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 is enabled in IBM InfoSphere Optim Performance Manager (OPM).

Vulnerability Details

CVE-ID: CVE-2014-3566

DESCRIPTION: IBM InfoSphere Optim Performance Manager could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and access the plaintext of encrypted connections.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97013 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Affected Products and Versions

IBM Optim Performance Manager for DB2 on Linux, UNIX, and Windows version 4.1 through 4.1.1

IBM InfoSphere Optim Performance Manager for DB2 on Linux, UNIX, and Windows version 5.1 through 5.3.1

Remediation/Fixes

OPM Version

| Download URL
—|—
4.1 – 5.1.1.1| Replace JRE (V6 SR16 Fix Pack 2)
5.2 | Fix Central (Interim Fix 6269)
5.3| Fix Central (Interim Fix 7386)
5.3.1| Fix Central (Interim Fix 8377)

For OPM versions 4.1 through 5.1.1.1, you must replace the IBM Runtime Environment, Java™ Technology Edition (JRE) that is installed with OPM, with the latest IBM Runtime Environment, Java™ Technology Edition (Version 6 Service Refresh 16 Fix Pack 2 and subsequent releases). Detailed instructions are available here: __“Updating the __IBM Runtime Environment, Java™ Technology Edition__ for InfoSphere Optim Performance Manager__”.

For OPM versions 5.2 through 5.3.1, installing the Interim Fix changes the web console server configuration so that it disables the SSLv3 protocol and permits only TLS 1.0 or higher for HTTPS connections.

After installing the Interim Fix, if you need to re-enable the SSLv3 protocol, edit the server.xml file that is located in the InfoSphere Optim Performance Manager installation directory:

wlp/usr/servers/dsweb/server.xml
Remove the following line and then save the file:

<include optional=“true” location=“./TLSOnlyConfig.xml”/>
A restart is not required for this change to take effect.

IBM recommends that you review your entire environment to identify areas that enable the SSLv3 protocol and take appropriate mitigation and remediation actions. The most immediate mitigation action that can be taken is disabling SSLv3.

Workarounds and Mitigations

IBM InfoSphere Optim Performance Manager (OPM) relies on IBM WebSphere Application Server (WAS) to manage the SSL protocol used for secure network connections. Older OPM versions (4.1 through 5.1.1.1) use WAS Smash, newer OPM versions (since 5.2) use WAS Liberty Profile.

For more details, see the _Workarounds and Mitigations _section in this document Security Bulletin: Vulnerability in SSLv3 affects IBM WebSphere Application Server (CVE-2014-3566).

The following steps outline how to apply these mitigations to OPM 5.2 through 5.3.1.

Edit the SSLConfig.xml file to specify the default SSL configuration to be used by IBM InfoSphere Optim Performance Manager. The SSLConfig.xml file is located in the InfoSphere Optim Performance Manager installation directory:

wlp/usr/servers/dsweb/SSLConfig.xml
Before making any changes the contents of the SSLConfig.xml file should look like this:
<server>
<keyStore id="defaultKeyStore" password="password"/>
</server>
A ‘ssl’ element can be added to specify the minimal level of security for the SSL protocol. Setting the ‘sslProtocol’ attribute to ”TLS” ensures that SSLv3 will no longer be used.

After making these changes, the contents of the SSLConfig.xml file may look like this:

<server>
**<ssl id="defaultSSLConfig"**
** keyStoreRef="defaultKeyStore"**
** sslProtocol="TLS" />**
<keyStore id="defaultKeyStore" password="password"/>
</server>
If an ‘ssl’ element already exists, ensure that it includes the attribute sslProtocol=“TLS”. There is no need to modify the ‘keyStore’ entry, if you have customized it, for example to point to your own key store location, you can retain the entry as is. It is not required to restart the web console server after this update.