Security Bulletin: Multiple vulnerabilities in NTP and OpenSSL affect IBM Netezza Firmware Diagnostics

Summary

Open Source NTP and OpenSSL are used by IBM Netezza Firmware Diagnostics. IBM Netezza Firmware Diagnostics Support Tools has addressed the applicable CVEs.

Vulnerability Details

CVEID: CVE-2016-2183**
DESCRIPTION:** OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a man-in-the-middle attack could exploit this vulnerability to recover the plaintext data and obtain sensitive information. This vulnerability is known as the SWEET32 Birthday attack.
CVSS Base Score: 3.7
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/116337 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2016-7431**
DESCRIPTION:** NTP could allow a remote attacker to bypass security restrictions, caused by the improper handling of Zero origin timestamp checks. An attacker could exploit this vulnerability to launch further attacks on the system.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/119091 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID: CVE-2016-7433**
DESCRIPTION:** NTP is vulnerable to a denial of service, caused by the inclusion of the root delay allowing for an incorrect root distance calculation. An attacker could exploit this vulnerability to cause a denial of service.
CVSS Base Score: 1.6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/119095 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

• • IBM Netezza Firmware Diagnostics 4.1.0.0 - 4.3.1.5

Remediation/Fixes

This download contains FDT Support Tools v2.0.0.7 which includes updated versions of IMMv1 and IMMv2 firmware for hosts. This updated firmware addresses the applicable CVEs.

Product

|

VRMF

|

Remediation/First Fix

—|—|—

IBM Netezza Firmware Diagnostics Support Tools

|

2.0.0.7

|

Link to Fix Central

• Workarounds and Mitigations

None