Security Bulletin: Vulnerability in RC4 stream cipher affects MegaRAID Storage Manager (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects MegaRAID Storage Manager. MegaRAID Storage Manager has addressed the vulnerability. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects MegaRAID Storage Manager. MegaRAID Storage Manager has addressed the...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM System Networking Switch Center (CVE-2015-7575)

Summary There is a vulnerability in IBMR; SDK JavaTM Technology Edition, Version 7 that is used by IBM System Networking Switch Center. This vulnerability, commonly referred to as "SLOTH", was disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details Summary There is a...

Security Bulletin: Logjam vulnerability affects IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch firmware (CVE-2015-4000)

Summary OpenSSL vulnerabilities were disclosed on June 11, 2015 by the OpenSSL Project. This includes Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol CVE-2015-4000. OpenSSL is used by IBM Flex System EN6131 40Gb Ethernet /IB6131 40Gb Infiniband Switch firmware...

Security Bulletin: Vulnerabilities in OpenSSL and MD5 Signature and Hash Algorithm (CVE-2015-7575) affect IBM System Networking RackSwitch products.

Summary IBM System Networking RackSwitch products listed below have addressed the following vulnerabilities, including the MD5 "SLOTH" vulnerability on TLS 1.2. Vulnerability Details Summary IBM System Networking RackSwitch products listed below have addressed the following vulnerabilities,...

Security Bulletin: Vulnerability with Diffie-Hellman ciphers may affect Juniper EX Series Network Switches sold by IBM for use in IBM Products (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects Juniper EX Series Network Switches sold by IBM for use in IBM Products. Vulnerability Details Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affec...

Security Bulletin: Vulnerability in RC4 cipher stream (CVE-2015-2808) and multiple vulnerabilities in IBM SDK Java Technology Edition affects IBM Systems Director.

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition 7 that is used by IBM Systems Director. These issues were disclosed as part of the IBM Java SDK updates in January and April 2015. This bulletin also addresses the RC4 bar mitzvah attack on SSL/TLS. Vulnerability Detail...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect Upward Integration Modules (UIM) (CVE-2014-3508, CVE-2014-5139, CVE-2014-3509, CVE-2014-3505, CVE-2014-3506, CVE-2014-3507, CVE-2014-3510, CVE-2014-3511, CVE-2014-3512)

Summary There are multiple vulnerabilities in OpenSSL that is used by Upward Integration Modules UIM. These issues were disclosed on August 6, 2014 by the OpenSSL Project. Vulnerability Details Summary There are multiple vulnerabilities in OpenSSL that is used by Upward Integration Modules UIM...

Security Bulletin: Vulnerability in RC4 stream cipher affects System x Integrated Management Module (IMM) (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects System x IMM. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects System x IMM. Vulnerability Details CVE-ID: CVE-2015-2808 Description: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Fabric Manager (IFM)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 7 that is used by IBM Fabric Manager IFM. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and includes the vulnerability commonlyreferred to as "SLOTH". Vulnerability Details...

Man-in-the-Middle (MitM)

openssl is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists as the TLS protocol 1.2 and earlier, when a DHEEXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHEEXPORT choice, which allows man-in-the-middle attackers to conduct...

Security Bulletin: CVE-2018-1719 vulnerability in IBM WebSphere application server may potentially affect IBM Workload Scheduler.

Summary CVE-2018-1719 vulnerability in IBM WebSphere application server may potentially affect IBM Workload Scheduler. Vulnerability Details CVEID: CVE-2018-1719 DESCRIPTION: IBM WebSphere Application Server could provide weaker than expected security under certain conditions. This could result i...

Security Bulletin: Weaker than expected security in WebSphere Application Server shipped with Jazz for Service Management (CVE-2018-1719)

Summary There is a potential for weaker than expected security in WebSphere Application Server which could result in TLS downgrade under certain conditions. This only applies if FIPS is enabled and the keystores/truststores are configured by the JVM property com.ibm.ssl.protocol. Vulnerability...

Ubuntu: Security Advisory (USN-3810-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : ppp vulnerability (USN-3810-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3810-1 advisory. Ivan Gotovchits discovered that ppp incorrectly handled the EAP-TLS protocol. A remote attacker could use this issue to cause ppp to crash...

Cannot connect to vCenter from PVS Console using stronger SCHANNEL Protocols, such as TLS 1.2

When running the XenDesktop Setup Wizard or the Streamed VM Wizard, and connecting to a vCenter Server that has been configured to only accept connections using TLS 1.1 or higher, the PVS Console could present an error stating that the Connection was closed. The error shown will have a text simil...

Security Bulletin: An OpenSSL vulnerability could affect IBM Performance Management products (CVE-2016-2183)

Summary OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a...

Security Bulletin: IBM b-type Network/Storage switches are affected by Sweet32: Birthday attacks on 64-bit block ciphers in TLS and OpenVPN (openssl ,redhat,openVPN) vulnerabilities.

Summary IBM b-type Network/Storage switches has addressed the following vulnerabilities CVE-2016-2183, CVE-2016-6329. Vulnerability Details Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the...

Security Bulletin: Vulnerability in IBM Java SDK affects Rational Functional Tester (CVE-2015-7575)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition that is used by Rational Functional Tester. This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS...

CVE-2018-1719

IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security under certain conditions. This could result in a downgrade of TLS protocol. A remote attacker could exploit this vulnerability to perform man-in-the-middle attacks. IBM X-Force ID: 147292...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK including Logjam affect IBM Tivoli System Automation for Integrated Operations Management

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 that is used by IBM Tivoli System Automation for Integrated Operations Management. These issues were disclosed as part of the IBM Java SDK updates in July 2015. This bulletin also addresses the Logjam Attac...