Lucene search

K
ibmIBMFE8CD63741EB0C201948EBAC06CC70F90DD67B3DB7F1AC791F315F256B1B4EBC
HistoryJun 15, 2018 - 7:02 a.m.

Security Bulletin: Vulnerabilities in OpenSSL affect IBM MQ Light (CVE-2014-3570, CVE-2014-3572, CVE-2014-8275, CVE-2015-0204, CVE-2015-0205)

2018-06-1507:02:38
www.ibm.com
17

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

Summary

OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by IBM MQ Light. IBM MQ Light has addressed the applicable CVEs.

Vulnerability Details

CVEID: CVE-2014-3570 DESCRIPTION: An unspecified error in OpenSSL related to the production of incorrect results on some platforms by Bignum squaring (BN_sqr) has an unknown attack vector and impact.
CVSS Base Score: 2.6
CVSS Temporal Score: See <http://exchange.xforce.ibmcloud.com/#/vulnerabilities/99710&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:N/I:P/A:N)

CVEID: CVE-2014-3572 DESCRIPTION: OpenSSL could provide weaker than expected security. The client accepts a handshake using an ephemeral ECDH ciphersuite with the server key exchange message omitted. An attacker could exploit this vulnerability to launch further attacks on the system.
CVSS Base Score: 1.2
CVSS Temporal Score: See <http://exchange.xforce.ibmcloud.com/#/vulnerabilities/99705&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:H/Au:N/C:N/I:P/A:N)

CVEID: CVE-2014-8275 DESCRIPTION: OpenSSL could allow a local attacker to bypass security restrictions, caused by the modification of the fingerprint without breaking the signature. An attacker could exploit this vulnerability using non-DER or invalid encodings outside the signed portion of a certificate bypass security restrictions and perform unauthorized actions.
CVSS Base Score: 1.2
CVSS Temporal Score: See <http://exchange.xforce.ibmcloud.com/#/vulnerabilities/99709&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:H/Au:N/C:N/I:P/A:N)

CVEID: CVE-2015-0204 DESCRIPTION: A vulnerability in the OpenSSL ssl3_get_key_exchange function could allow a remote attacker to downgrade the security of certain TLS connections. An OpenSSL client accepts the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. This could allow a remote attacker using man-in-the-middle techniques to facilitate brute-force decryption of TLS/SSL traffic between vulnerable clients and servers.

This vulnerability is also known as the FREAK attack.

CVSS Base Score: 4.3
CVSS Temporal Score: See <http://exchange.xforce.ibmcloud.com/#/vulnerabilities/99707&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVEID: CVE-2015-0205 DESCRIPTION: OpenSSL could allow a remote authenticated attacker to bypass security restrictions, caused by the acceptance of a DH certificate for client authentication without verification. An attacker could exploit this vulnerability to authenticate without the use of a private key.
CVSS Base Score: 2.1
CVSS Temporal Score: See <http://exchange.xforce.ibmcloud.com/#/vulnerabilities/99708&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:S/C:N/I:P/A:N)

Affected Products and Versions

The vulnerabilities affect users of the mqlight IBM MQ Light Client Module for Node.js® on all platforms at the following versions:
1.0.2014090800
1.0.2014090801
1.0.2014091000-red
1.0.2014091001

It also affects users of the mqlight-dev IBM MQ Light Client Module for Node.js between versions 1.0.2014090300 and 1.0.2014111002 inclusive.

Remediation/Fixes

Users of the IBM MQ Light Client Module for Node.js at an affected version should update to the latest version of the IBM MQ Light Client Module for Node.js as found on https://www.npmjs.com.

You should verify applying this fix does not cause any compatibility issues.

IBM recommends that you review your entire environment to identify vulnerable releases of OpenSSL and areas that enable the TLS or SSL protocol and take appropriate mitigation and remediation actions. This includes the Node.js runtime environment.

CPENameOperatorVersion
ibm mq lighteq1.0

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

Related for FE8CD63741EB0C201948EBAC06CC70F90DD67B3DB7F1AC791F315F256B1B4EBC