An interface on the IBM BladeCenter Advanced Management Module (AMM) may expose user account names and passwords that have been configured on that AMM.
The FSM and compatible agents contain a version of openssl that contained the 3 vulnerabilities listed above.
Vulnerability Details:
CVE ID |Description |
Fix Target****Date
| Fix Version
—|—|—|—
CVE-2013-4353
CVSS Base Score: 5
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/90201>
CVSS Environmental Score: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
| Invalid TLS handshake causes null pointer exception. | 05/09/14 |
V 1.2.0.1
V 1.2.1.1
V 1.3.0.2
V 1.3.1.1
CVE-2013-6450
CVSS Base Score: 4.3
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/90069>
CVSS Environmental Score: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)
| Remote attacker could cause openssl to crash due to improperly maintained data structures. | 05/09/14 |
V 1.2.0.1
V 1.2.1.1
V 1.3.0.2
V 1.3.1.1
CVE-2013-6449
CVSS Base Score: 4.3
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/90068>
CVSS Environmental Score: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)
| Attacker can crash openssl with a TLS1.2 exploit. | 05/09/14 |
V 1.2.0.1
V 1.2.1.1
V 1.3.0.2
V 1.3.1.1
From the FSM command line enter lsconfig –V to determine the level of FSM installed.
FSM
Agents
NON-AFFECTED PRODUCTS and VERSIONS
The following FSM levels are not vulnerable to these CVEs.
Agent vulnerability is dependent on which platform the agent is installed. Details for each agent are included in the Remediation section below.
The remediation for these vulnerabilities is a subset of the action required for CVE-2014-0160 (also referred to as Heartbleed).
IBM recommends that you complete the remediation for CVE-2014-0160. When you have completed the CVE-2014-0160 remediation you will no longer be vulnerable to the exposures listed in this Security Bulletin.
The Security Bulletin for IBM Flex System Manager and the associated agents for CVE-2014-0160 is here.
If you have already completed the remediation for CVE-2014-0160, then no further action is required.
None Known
Related Information:
IBM Secure Engineering Web Portal
Acknowledgement
None
Change History
7 May 2014_: Original Copy Published_
Note: According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an “industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response.” IBM PROVIDES THE CVSS SCORES “AS IS” WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.