Security Bulletin: Power System Firmware is affected by openssl vulnerabilities(CVE-2013-4353, CVE -2013-6449)

Summary

Power System Firmware is affected by openssl vulnerabilities.

Vulnerability Details

CVE ID: CVE-2013-4353

DESCRIPTION: A carefully crafted invalid TLS handshake could crash OpenSSL with a NULL pointer exception. A malicious server could use this flaw to crash a connecting client. This issue only affected OpenSSL 1.0.1 versions.

CVSS Base Score: 5
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/90201&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVE ID: CVE-2013-6449

DESCRIPTION: A flaw in OpenSSL can cause an application using OpenSSL to crash when using TLS version 1.2. This issue only affected OpenSSL 1.0.1 versions.
OpenSSL is vulnerable to a denial of service, caused by an error in the ssl_get_algorithm2 function. A remote attacker could exploit this vulnerability using specially-crafted traffic from a TLS 1.2 client to cause the daemon to crash.

CVSS Base Score: 4.3
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/90068&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

Affected Products and Versions

Firmware 770 Affected Platforms:
IBM Power 780 (9179-MHC)
IBM Power 770 (9117-MMC)
IBM Power 760 (9109-RMD)
IBM Power 750 (8408-E8D)
IBM PowerLinux 7R4 (8248-L4T)
IBM PowerLinux 7R2 (8246-L2D)
IBM PowerLinux 7R2 (8246-L2T)
IBM PowerLinux 7R1 (8246-L1D)
IBM PowerLinux 7R1 (8246-L1T)
IBM Power 740 (8205-E6D)
IBM Power 730 (8231-E2D)
IBM Power 720 (8202-E4D)
IBM Power 720 (8202-40A)
IBM Power 710 (8231-E1D)
IBM Power 710 (8268-E1D)

Affected Firmware Versions (740)
770.00: 01AL770_032_032
770.10: 01Ax770_038_032
770.20: 01Ax770_048_032
770.21: 01Ax770_052_032
770.22: 01Ax770_055_032
770.31: 01Ax770_063_032

Firmware 780 Affected Platforms:
IBM Power 770 (9117-MMB)
IBM Power 780 (9179-MHB)
IBM Power 770 (9117-MMD)
IBM Power 780 (9179-MHD)
IBM Power ESE (8412-EAD)
IBM Power 795 (9119-FHB)

Affected Firmware Versions(780)
780.00: 01Ax780_040_040
780.01: 01Ax780_050_040
780.02: 01Ax780_054_040

Remediation/Fixes

Customers on Version 770, install 770.32: 01Ax770_076_032 or higher
Customers on Version 780, install 780.10: 01Ax780_056_040 or higher

Workarounds and Mitigations

None known

Get Notified about Future Security Bulletins

Subscribe to [My Notifications](< http://www-01.ibm.com/software/support/einfo.html&gt;) to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Acknowledgement

None

Change History

10/10/14: Information for Versions 770 and 780 is added

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an “industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response.” IBM PROVIDES THE CVSS SCORES ““AS IS”” WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. “Affected Products and Versions” referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.

{“0”:{“Product”:{“code”:“SSGD7C”,“label”:“Power System E880 Server (9119-MHE)”},“Business Unit”:{“code”:“BU058”,“label”:“IBM Infrastructure w/TPS”},“Component”:“–”,“Platform”:[{“code”:“PF025”,“label”:“Platform Independent”}],“Version”:“Version Independent”,“Edition”:“”,“Line of Business”:{“code”:“LOB57”,“label”:“Power”}},“1”:{“Product”:{“code”:“HWQQQ”,“label”:“PRODUCT NOT FOUND”},“Business Unit”:{“code”:“BU055”,“label”:“Cognitive Applications”},“Component”:" “,“Platform”:[{“code”:”“,“label”:”“}],“Version”:”“,“Edition”:”“,“Line of Business”:{“code”:”“,“label”:”“}},“2”:{“Product”:{“code”:“HWQQQ”,“label”:“PRODUCT NOT FOUND”},“Business Unit”:{“code”:“BU055”,“label”:“Cognitive Applications”},“Component”:” “,“Platform”:[{“code”:”“,“label”:”“}],“Version”:”“,“Edition”:”“,“Line of Business”:{“code”:”“,“label”:”“}},“3”:{“Product”:{“code”:“HWQQQ”,“label”:“PRODUCT NOT FOUND”},“Business Unit”:{“code”:“BU055”,“label”:“Cognitive Applications”},“Component”:” “,“Platform”:[{“code”:”“,“label”:”“}],“Version”:”“,“Edition”:”“,“Line of Business”:{“code”:”“,“label”:”“}},“4”:{“Product”:{“code”:“HWQQQ”,“label”:“PRODUCT NOT FOUND”},“Business Unit”:{“code”:“BU055”,“label”:“Cognitive Applications”},“Component”:” “,“Platform”:[{“code”:”“,“label”:”“}],“Version”:”“,“Edition”:”“,“Line of Business”:{“code”:”“,“label”:”“}},“5”:{“Product”:{“code”:“HWQQQ”,“label”:“PRODUCT NOT FOUND”},“Business Unit”:{“code”:“BU055”,“label”:“Cognitive Applications”},“Component”:” “,“Platform”:[{“code”:”“,“label”:”“}],“Version”:”“,“Edition”:”“,“Line of Business”:{“code”:”“,“label”:”“}},“6”:{“Product”:{“code”:“HWQQQ”,“label”:“PRODUCT NOT FOUND”},“Business Unit”:{“code”:“BU055”,“label”:“Cognitive Applications”},“Component”:” “,“Platform”:[{“code”:”“,“label”:”“}],“Version”:”“,“Edition”:”“,“Line of Business”:{“code”:”“,“label”:”“}},“7”:{“Product”:{“code”:“HWQQQ”,“label”:“PRODUCT NOT FOUND”},“Business Unit”:{“code”:“BU055”,“label”:“Cognitive Applications”},“Component”:” “,“Platform”:[{“code”:”“,“label”:”“}],“Version”:”“,“Edition”:”“,“Line of Business”:{“code”:”“,“label”:”“}},“8”:{“Product”:{“code”:“QU92JUT”,“label”:“8202”},“Business Unit”:{“code”:“BU054”,“label”:“Systems w/TPS”},“Component”:” “,“Platform”:[{“code”:”“,“label”:”“}],“Version”:”“,“Edition”:”“,“Line of Business”:{“code”:”“,“label”:”“}},“9”:{“Product”:{“code”:“HWQQQ”,“label”:“PRODUCT NOT FOUND”},“Business Unit”:{“code”:“BU055”,“label”:“Cognitive Applications”},“Component”:” “,“Platform”:[{“code”:”“,“label”:”“}],“Version”:”“,“Edition”:”“,“Line of Business”:{“code”:”“,“label”:”“}},“10”:{“Product”:{“code”:“HWQQQ”,“label”:“PRODUCT NOT FOUND”},“Business Unit”:{“code”:“BU055”,“label”:“Cognitive Applications”},“Component”:” “,“Platform”:[{“code”:”“,“label”:”“}],“Version”:”“,“Edition”:”“,“Line of Business”:{“code”:”“,“label”:”“}},“11”:{“Product”:{“code”:“HWQQQ”,“label”:“PRODUCT NOT FOUND”},“Business Unit”:{“code”:“BU055”,“label”:“Cognitive Applications”},“Component”:” “,“Platform”:[{“code”:”“,“label”:”“}],“Version”:”“,“Edition”:”“,“Line of Business”:{“code”:”“,“label”:”“}},“12”:{“Product”:{“code”:“HWQQQ”,“label”:“PRODUCT NOT FOUND”},“Business Unit”:{“code”:“BU055”,“label”:“Cognitive Applications”},“Component”:” “,“Platform”:[{“code”:”“,“label”:”“}],“Version”:”“,“Edition”:”“,“Line of Business”:{“code”:”“,“label”:”"}},“102”:{“Product”:{“code”:“SSZ53RS”,“label”:“Power System E870 Server (9119-MME)”}},“13”:null,“14”:null,“15”:null,“16”:null,“17”:null,“18”:null,“19”:null,“20”:null,“21”:null,“22”:null,“23”:null,“24”:null,“25”:null,“26”:null,“27”:null,“28”:null,“29”:null,“30”:null,“31”:null,“32”:null,“33”:null,“34”:null,“35”:null,“36”:null,“37”:null,“38”:null,“39”:null,“40”:null,“41”:null,“42”:null,“43”:null,“44”:null,“45”:null,“46”:null,“47”:null,“48”:null,“49”:null,“50”:null,“51”:null,“52”:null,“53”:null,“54”:null,“55”:null,“56”:null,“57”:null,“58”:null,“59”:null,“60”:null,“61”:null,“62”:null,“63”:null,“64”:null,“65”:null,“66”:null,“67”:null,“68”:null,“69”:null,“70”:null,“71”:null,“72”:null,“73”:null,“74”:null,“75”:null,“76”:null,“77”:null,“78”:null,“79”:null,“80”:null,“81”:null,“82”:null,“83”:null,“84”:null,“85”:null,“86”:null,“87”:null,“88”:null,“89”:null,“90”:null,“91”:null,“92”:null,“93”:null,“94”:null,“95”:null,“96”:null,“97”:null,“98”:null,“99”:null,“100”:null,“101”:null}