Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects RIT and RTCP in Rational Test Workbench, RTCP and RIT Agent in Rational Test Virtualization Server, and RIT Agent in Rational Performance Test Server (CVE-2015-7575)

Summary

The MD5 “SLOTH” vulnerability on TLS 1.2 affects Rational Integration Tester and Rational Test Control Panel in Rational Test Workbench, Rational Test Control Panel and RIT Agent in Rational Test Virtualization Server, and RIT Agent in Rational Performance Test Server

Vulnerability Details

CVEID: CVE-2015-7575

**Description:**The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message during a TLS handshake. An attacker could exploit this vulnerability using man-in-the-middle techniques to impersonate a TLS server and obtain credentials.

**CVSS Base Score:**7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/109415 for the current score *CVSS Environmental Score:**Undefined **CVSS Vector: **(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)

Affected Products and Versions

Rational Integration Tester component in Rational Test Workbench,** Rational Test Control Panelcomponent in Rational Test Workbench and Rational Test Virtualization Server, andRIT Agent**in Rational Test Virtualization Server and Rational Performance Test Server versions:

All versions from 8.0 up to and including8.7.1.1

Remediation/Fixes

The fixes for the CVE(s) mentioned above have been incorporated into an interim fix available on IBM Fix Central. Prior to patching, you should ensure that you have the latest fix pack installed for your supported version.

Upgrade your installation as follows:

1. Download the interim fix entitled 'Rational-RTW-SLOTH-MD5.zip’, 'Rational-RTVS-SLOTH-MD5.zip’ or ‘Rational-RPTS-SLOTH-MD5.zip_’_ and unzip the contents into a temporary directory
2. Locate the sub-directory from within the extracted zip relevant to your version of the product (the sub-directories are named by version)
3. Exit Rational Integration Tester if it is open and stop Rational Test Control Panel, agents and proxies if they are running
4. Copy the java.security file from within the appropriate sub-directory located in step (2) into the following product install locations:

• RationalIntegrationTester/jre/lib/security
• RationalTestControlPanel/jre/lib/security
• RIT-Agent/jre/lib/security
• RIT-Platform/jre/lib/security (only for versions earlier than 8.7)
• Note the default install location is C:\Program Files\IBM (Windows), /opt/IBM (AIX / Linux / Solaris) or /Applications/IBM/ (OSX - for versions 8.7.1.0 and 8.7.1.1)
• Restart the products

Notes:

• When updating an installation to a later version, the security fix detailed above will have to be re-applied after the update
• You should verify applying this fix does not cause any compatibility issues. The fix disables MD5 signature hash by default. If you change the default setting after applying the fix, you will expose yourself to the attack described above. IBM recommends that you review your entire environment to identify other areas where you have enabled the MD5 signature hash and take appropriate mitigation and remediation actions.
• For the unsupported version 5.4.0, IBM recommends upgrading to a fixed, supported version of the product.

Workarounds and Mitigations

None