OpenSSL vulnerabilities were disclosed on May 3, 2016 by the OpenSSL Project. OpenSSL is used by IBM Systems Director. IBM Systems Director has addressed the applicable CVEs.
CVEID:CVE-2016-2108
**DESCRIPTION:*OpenSSL could allow a remote attacker to execute arbitrary code on the system, caused by a buffer underflow when deserializing untrusted ASN.1 structures and later reserializes them. An attacker could exploit this vulnerability to corrupt memory and trigger an out-of-bounds write and execute arbitrary code on the system.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112853 for the current score
CVSS Environmental Score: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID:CVE-2016-2109
**DESCRIPTION:*OpenSSL is vulnerable to a denial of service, caused by a memory allocation error. By reading specially crafted ASN.1 data from a BIO using functions such as d2i_CMS_bio(), an attacker could exploit this vulnerability to consume all available resources and exhaust memory.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112857 for the current score
CVSS Environmental Score: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID:CVE-2016-2176
**DESCRIPTION:*OpenSSL could allow a remote attacker to obtain sensitive information, By sending an overly long ASN.1 string to the X509_NAME_oneline() function, an attacker could exploit this vulnerability to return arbitrary stack data in the buffer.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112858 for the current score
CVSS Environmental Score: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
IBM Systems Director:
Ā· 5.2.x.x
Ā· 6.1.x.x
Ā· 6.2.0.x
Ā· 6.2.1.x
Ā· 6.3.0.0
Ā· 6.3.1.0
Ā· 6.3.1.1
Ā· 6.3.2.0
Ā· 6.3.2.1
Ā· 6.3.2.2
Ā· 6.3.3.0
Ā· 6.3.3.1
Ā· 6.3.5.0
Ā· 6.3.6.0
Ā· 6.3.7.0
Releases 5.2.x.x, 6.1.x.x , 6.2 and version pre 6.3.5 are unsupported and will not be fixed.
Please follow the instructions provided to apply fixes on the below releases.
1. Click the following link:
2. Select the following fix pack:
SysDir6_3_x_0_IT16425_IT16426_IT16427_IT16430.zip
Note: This fix package includes fixes for all the supported platforms.
3. Follow the Instructions beneath the table for your desired platform
Product | VRMF | APAR | Associated Technote |
---|---|---|---|
IBM Systems Director and IBM Systems Director Platform Agent | Xlinux Platform Agent 6.3.5 to 6.3.7 | IT16425 | 787618975 |
Go to <http://www-01.ibm.com/support/us/search/> and search for the technote number. | |||
IBM Systems Director and IBM Systems Director Platform Agent | Windows Platform Agent 6.3.5 to 6.3.7 | IT16426 | 787673953 |
Go to <http://www-01.ibm.com/support/us/search/> and search for the technote number. | |||
IBM Systems Director and IBM Systems Director Platform Agent | Power Linux Platform Agent 6.3.5 to 6.3.7 | IT16427 | 787614786 |
Go to <http://www-01.ibm.com/support/us/search/> and search for the technote number. | |||
IBM Systems Director and | |||
IBM Systems Director Platform Agent | Zlinux Platform Agent 6.2.0.x to 6.3.6 | IT16430 | 787637652 |
Go to <http://www-01.ibm.com/support/us/search/> and search for the technote number. |
None known