Security Bulletin: IBM Sterling B2B Integrator is Vulnerable to a Robot Security Vulnerability (CVE-2017-6168)

Summary

IBM Sterling B2B Integrator is vulnerable to a robot security vulnerability. This could allow an attacker to obtain encrypted data in clear text.

Vulnerability Details

CVEID: CVE-2017-6168 DESCRIPTION: F5 BIG-IP virtual servers configured with a Client SSL profile could allow a remote attacker to obtain sensitive information, caused by an RSA Adaptive Chosen Ciphertext (Bleichenbacher) attack. An attacker can exploit this vulnerability to obtain the data in the encrypted messages once the TLS session has completed. Note: This vulnerability is also known as the ROBOT attack.
CVSS Base Score: 9.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/135008&gt;

for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Affected Products and Versions

IBM Sterling B2B Integrator 5.2 - 5.2.5

Remediation/Fixes

PRODUCT & Version

|

APAR

|

Remediation/Fix

—|—|—

IBM Sterling B2B Integrator 5.2 - 5.2.5

| IT24190 |

1. Apply Fix Pack 5020500_18 or 5020603_5 available on

Fix Central

2. Download 5.2.5-OtherSoftware-SI-All-SSL-4.3.7.103 from

Fix Central

3. Unzip ssl-4.3.7.103.zip and put three jars to <SI_Install_Dir>/jdk/jre/lib/ext

4. Restart IBM Sterling B2B Integrator

Workarounds and Mitigations

None