Security Bulletin: TS3000(TSSC) is affected by a vulnerability in OpenSSL (CVE-2014-0160)

Abstract

A security vulnerability has been discovered in OpenSSL.

Content

CVE-ID:CVE-2014-0160

**DESCRIPTION:**OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerability to expose 64k of private memory and retrieve secret keys. An attacker can repeatedly expose additional 64k chunks of memory. This vulnerability can be remotely exploited, authentication is not required and the exploit is not complex. An exploit can only partially affect the confidentially, but not integrity or availability.

CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/92322
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

WARNING: We strongly encourage you to take action as soon as possible as potential implications to your environment may be more serious than indicated by the CVSS score.

Affected Products and Versions

TS3000 (TSSC) Version 7.2.x

Remediation/Fixes** **

[{“Product”:{“code”:“STFS69”,“label”:“TS7700”},“Business Unit”:{“code”:“BU058”,“label”:“IBM Infrastructure w/TPS”},“Component”:“TSSC”,“Platform”:[{“code”:“PF025”,“label”:“Platform Independent”}],“Version”:“Version Independent”,“Edition”:“N/A”,“Line of Business”:{“code”:“LOB26”,“label”:“Storage”}}]

Product Synonym

TS7720;TS7740;TS7700;TS3500;TS7650;TS7680;3592-C07