Security Bulletin: A SSLv3 POODLE Attack vulnerabilities in IBM SDK for Java shipped by IBM Webshere Application Server shipped with IBM Tivoli/Security Key Lifecycle Manager (CVE-2014-3566)

Summary

IBM SDK for Java shipped by IBM Webshere Application Server is shipped as a component of IBM Tivoli/Security Key Lifecycle Manager. Information about a security vulnerability affecting IBM SDK for Java shipped by IBM Webshere Application Server has been published in a security bulletin.

Vulnerability Details

CVEID: CVE-2014-3566

DESCRIPTION:
Product could allow a remote attacker to obtain sensitive information, casued by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and access the plaintext of encrypted connections.
Please consult the security bulletin <http://www-01.ibm.com/support/docview.wss?uid=swg21687740&gt; for vulnerability details and information about fixes.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97013 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Affected Products and Versions

Principal Product and Version

| Affected Supporting Product and Version
—|—
IBM Tivoli Key Lifecycle Manager 1.0 | IBM Websphere Application Server 6.1.0.0 through 6.1.0.47 - Java SDK 5 SR16
IBM Tivoli Key Lifecycle Manager 2.0| IBM Websphere Application Server 6.1.0.0 through 6.1.0.47 - Java SDK 5 SR16
IBM Tivoli Key Lifecycle Manager 2.0.1| IBM Websphere Application Server 6.1.0.0 through 6.1.0.47 - Java SDK 5 SR16
IBM Security Key Lifecycle Manager 2.5 | IBM Websphere Application Server 8.5.5.0 through 8.5.5.2 - Java SDK 6R1 SR8

Remediation/Fixes

Product

| VRMF| Remediation/First Fix
—|—|—
IBM Tivoli Key Lifecycle Manager | 1.0| 1.0.0-TIV-TKLM-FP0006
IBM Tivoli Key Lifecycle Manager | 2.0| 2.0.0-ISS-TKLM-FP0008
IBM Tivoli Key Lifecycle Manager | 2.0.1| 2.0.1-ISS-TKLM-FP0006
IBM Security Key Lifecycle Manager | 2.5| 2.5.0-ISS-SKLM-FP0004

Workarounds and Mitigations

Download and apply Websphere Application Server ifix manually. See security bulletin
Multiple vulnerabilities in IBM Java SDK affect WebSphere Application Server January 2015 CPU