Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Storwize V7000 Unified (CVE-2015-2808)

Summary

The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM Storwize V7000 Unified.

Vulnerability Details

CVEID: CVE-2015-2808

DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this vulnerability to remotely expose account credentials without requiring an active man-in-the-middle session. Successful exploitation could allow an attacker to retrieve credit card data or other sensitive information. This vulnerability is commonly referred to as “Bar Mitzvah Attack”.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101851 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

Affected Products and Versions

IBM Storwize V7000 Unified

All products are affected when running code releases 1.3, 1.4 and 1.5 except for version 1.5.2.0 and above.

Remediation/Fixes

IBM recommends that you fix this vulnerability by upgrading affected versions of IBM Storwize V7000 Unified to the following code level or higher:

1.5.2.0_
__
_Latest Storwize V7000 Unified Software

After the upgrade has completed, please run one of the following commands …

chsecurity -sslprotocol 2
chsecurity -sslprotocol 3
IBM Storwize V7000 Unified Knowledge Center - chsecurity command

The requirement to run chsecurity will be removed in a future PTF.