A vulnerability has been addressed in the GSKit component of IBM Security SiteProtector System.
CVEID: CVE-2016-0201 **
DESCRIPTION:** IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit this vulnerability to obtain authentication credentials.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/109310 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
IBM Security SiteProtector System 3.0 and 3.1.1
Apply the appropriate eXPress Updates (XPUs) as identified in the SiteProtector Console Agent view:
For SiteProtector 3.0:
SiteProtector Core Component
|
ServicePack3_0_0_10.xpu
—|—
Event Collector Component
|
RSEvntCol_WINNT_XXX_ST_3_0_0_9.xpu
Agent Manager Component
|
AgentManager_WINNT_XXX_ST_3_0_0_55.xpu
For SiteProtector 3.1.1:
SiteProtector Core Component
|
ServicePack3_1_1_5.xpu
—|—
Event Collector Component
|
RSEvntCol_WINNT_XXX_ST_3_1_1_5.xpu
Agent Manager Component
|
AgentManager_WINNT_XXX_ST_3_1_1_25.xpu
Update Server Component
|
UpdateServer_3_1_1_6.pkg
Event Archiver Component
|
EventArchiver_3_1_1_4.pkg
Event Archiver Importer Component
|
EventArchiverImporter_3_1_1_4.zip
Manual Upgrader Component
|
MU_3_1_1_5.xpu
Certificate Management Tools
|
CertificateManagerTools_3_1_1_3.zip
Please note that the Update Server, Event Archiver and Manual Upgrader are automatically updated by default. In addition, the same versions of these components apply to both releases of SiteProtector.
Alternatively, the packages can be manually obtained from the IBM Security License Key and Download Center using the following URL:
<https://ibmss.flexnetoperations.com/service/ibms/login>
The Certificate Management Tools can only be obtained from the IBM Security License Key and Download Center.
None