Security Bulletin: Security exposure in IBM Concert (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470)

Summary

6 new OpenSSL Security Issues officially announced [05 Jun 2014]

Vulnerability Details

An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can decrypt and modify traffic from the attacked client and server.

The attack can only be performed between a vulnerable client and server. OpenSSL clients are vulnerable in all versions of OpenSSL. Servers are only known to be vulnerable in OpenSSL 1.0.1 and 1.0.2-beta1.

Affected Products and Versions

IBM Cognos Concert 4.0.2

Remediation/Fixes

This issue was resolved in Concert 4.0.2.1 released on June 7, 2014.

Workarounds and Mitigations

None known. Apply fix pack.