Security Bulletin: A security vulnerability has been identified in Micosoft SQL Server Express shipped with IBM Robotic Process Automation with Automation Anywhere CVE-2014-3566

Summary

Microsoft SQL Server Express 2014 is shipped with IBM Robotic Process Automation with Automation Anywhere. Information about a security vulnerability affecting Microsoft SQL Server Express 2014 has been published in a security bulletin.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

The affected part is the database communication between the Control Room and the Microsoft SQL Server database.

DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and access the plain text of encrypted connections.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97013 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Affected Products and Versions

IBM Robotic Process Automation with Automation Anywhere v10.0 and v10.0 CF2017.12

Remediation/Fixes

Refer to the following security bulletins for vulnerability details and information about fixes addressed by Microsoft SQL Server Expresss 2014 which is shipped with IBM Robotic Process Automation with Automation Anywhere.

Workarounds and Mitigations

Upgrading to Microsoft SQL Server Express SP1 Cumulative Update 5 and later resolves CVE-2014-3566 with the provided express install. No configuration change is needed for IBM Robotic Process Automation with Automation Anywhere.