: IBM Systems Director contains a version of openssl that contained the 3 vulnerabilities listed above.
IBM Systems Director contains a version ofopenssl that contained the 3 vulnerabilities listed above.
Vulnerability Details:
CVE-ID: CVE-2013-4353 **
Description:** Invalid TLS handshake causes null pointer exception which could result in a denial of service.
CVSS Base Score: 5.0
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/90201>
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVE-ID: CVE-2013-6450 **
Description:** Remote attacker could cause openssl to crash due to improperly maintained data structures.
CVSS Base Score: 5.0
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/90069>
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVE-ID: CVE-2013-6449 **
Description:** Remote attacker could cause openssl to crash using a specially crafted traffic from a TLS1.2 client.
CVSS Base Score: 5.0
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/90068>
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)
From the ISD command line enter smcli lsver to determine the level of ISD installed.
Non-affected products and versions
The remediation for these vulnerabilities is a subset of the action required for CVE-2014-0160 (also referred to as Heartbleed).
IBM recommends that you first complete the remediation for CVE-2014-0160. When you have completed the CVE-2014-0160 remediation you will no longer be vulnerable to the exposures listed in this Security Bulletin.
The Fix Pack for CVE-2014-0160 for IBM Systems Director is located at this link:
http://www.ibm.com/support/fixcentral/swg/quickorder?parent=ibm~Director&product=ibm/Director/SystemsDirector&release=All&platform=All&function=fixId&fixids=SysDir6_3_x_0_IT01062_IT01063_IT01199&includeRequisites=1&includeSupersedes=0&downloadMethod=ddp&source=fc
If you have already completed the remediation for CVE-2014-0160, then no further action is required.
None Known
Related Information:
IBM Secure Engineering Web Portal
Acknowledgement
None
Change History
13 May 2014: Original Copy Published
Note: According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an “industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response.” IBM PROVIDES THE CVSS SCORES “AS IS” WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.