Security Bulletin: Vulnerabilities in OpenSSL affect IBM b-type SAN switches and directors (CVE-2016-2108)

Summary

OpenSSL vulnerabilities were disclosed on May 3, 2016 by the OpenSSL Project. OpenSSL is used by IBM b-type SAN switches and directors has addressed the applicable CVE.

Vulnerability Details

CVEID: CVE-2016-2108**
DESCRIPTION:** OpenSSL could allow a remote attacker to execute arbitrary code on the system, caused by a buffer underflow when deserializing untrusted ASN.1 structures and later reserializes them. An attacker could exploit this vulnerability to corrupt memory and trigger an out-of-bounds write and execute arbitrary code on the system.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112853 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

FOS versions prior to 7.4.2

FOS versions prior to 8.1.0c

IBM Network Advisor versions prior to 14.0.2

Remediation/Fixes

Product

| VRMF| Fix
—|—|—
FOS| 7.4.2| __http://www-01.ibm.com/support/docview.wss?uid=ssg1S1003855__
_FOS _| 8.1.0c| _http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009577_
IBM Network Advisor| 14.0.2| __http://www-01.ibm.com/support/docview.wss?uid=ssg1S7005391__

Workarounds and Mitigations

None