Security Bulletin: This Power System update is being released to address CVE-2018-12384

Summary

POWER9: In response to a data leak vulnerability in the network security services, a new Power Systems firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE-2018-12384.
This man-in-the-middle attack could provide false completion or errant network transactions or exposure of sensitive data from intercepted SSL connections to ASMI, Redfish, or the service processor message server.

Vulnerability Details

CVEID: CVE-2018-12384
DESCRIPTION: Network Security Services (NSS) could allow a remote attacker to obtain sensitive information, caused by the improper handling of an SSLv2-compatible ClientHello message. By conducting a passive replay attack, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base Score: 4.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/150436&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)

The firmware update can be obtained from FixCentral by specifying the Product and fix level as specified in this Remediation section.

Affected Products and Versions

Firmware releases FW910 and FW920 are affected.

Firmware releases FW810, FW820, FW830, FW840, FW860 are affected.

Remediation/Fixes

Customers with the products below, install FW910.30

1. IBM Power Systems S922 (9009-22A)

2. IBM Power Systems H922 (9223-22H)

3. IBM Power Systems S914 (9009-41A)

4. IBM Power Systems S924 (9009-42A)

5. IBM Power Systems H924 (9223-42H)

6. IBM Power Systems L922 (9008-22L)

Customers with the products below, install FW920.30

1. IBM Power Systems E950(9040-MR9)

2. IBM Power Systems E980(9080-M9S)

Customers with the products below, install FW860.70

1. IBM Power System S812(8284-21A)

2. IBM Power System S822(8284-22A)

3. IBM Power System S814(8286-41A)

4. IBM Power System S824(8286-42A)

5. IBM Power System S812L(8247-21L)

6. IBM Power System S822L(8247-22L)

7. IBM Power System S824L(8247-42L)

8. IBM Power System E850(8408-E8E)

9. IBM Power System E850C(8408-44E)

10. IBM Power System E870(9119-MME)

11. IBM Power System E870C(9080-MME)

12. IBM Power System E880(9119-MHE)

13. IBM Power System E880C(9080-MHE)

14. IBM Power System S812L(5148-21L)

15. IBM Power System S822L(5148-22L)