SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 can be enabled in IBM Rational DOORS Web Access.
| Subscribe to My Notifications to be notified of important product support alerts like this.
CVE ID: CVE-2014-3566** **
Description: Product could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and access the plaintext of encrypted connections.
CVSS Base Score: 4.3 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/97013> for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Rational DOORS Web Access version 9.6.0.x, 9.5.2.x, 9.5.1.x, 9.5.0.x, 1.5.0.x, 1.4.0.x.
None
IBM recommends that you review your entire environment to identify areas that enable the SSLv3 protocol and take appropriate mitigation and remediation actions. The most immediate mitigation action that can be taken is disabling SSLv3.
To avoid this vulnerability, configure the Apache Tomcat server.xml file in your Rational DOORS Web Access installation to disable SSLv3 and instead use TLS v1.2 or v1.1. Note that TLS v1.2 is more secure, but not all servers, clients, and browsers support this protocol. Do not use TLSv1.0.
Procedure:
To access the configuration files for Rational DOORS Web Access for SSL or TLS, review the help topic Configuring Rational DOORS Web Access to use SSL or TLS** **for more details.
In the SSL JSSE HTTP Connector section of the server.xml file, set the following values.**
****For Rational DOORS Web Access versions 9.5.2.x, 9.5.1.x, 9.5.0.x, 1.5.0.x, 1.4.0.x (prior to Tomcat 6.0.39): ``<Connector port="8443" protocol="HTTP/1.1" maxThreads="150" clientAuth="false" SSLEnabled="true" scheme="https" secure="true" ``**sslProtocol="TLS"**`` ``**protocols="TLSv1.2,TLSv1.1"**``/>``** **
****For Rational DOORS Web Access versions 9.6.0.x (Tomcat 6.0.39 and later):`
<Connector port="8443" protocol="HTTP/1.1" maxThreads="150" clientAuth="false" SSLEnabled="true" scheme="https" secure="true"
sslProtocol=“TLS” sslEnabledProtocols=“TLSv1.2,TLSv1.1”/>
3. If you are using APR, use the following values:
<Connector... maxThreads="200" enableLookups="true" disableUploadTimeout="true" acceptCount="100" scheme="https" secure="true" SSLEnabled="true"
SSLProtocol=“TLSv1” SSLCertificateFile="${catalina.base}/conf/localhost.crt" SSLCertificateKeyFile="${catalina.base}/conf/localhost.key
" />``
**`
4. Save and close the server.xml file.
You can test the SSL/TLS version configuration in Tomcat by running the following commands in openssl:
openssl s_client -connect
testhost:
port -ssl3
openssl s_client -connect
testhost:
port -tls1
openssl s_client -connect
testhost:
port -tls1_1
openssl s_client -connect
testhost:
port -tls1_2