Security Bulletin: Vulnerability in OpenSSL affects IBM Sterling Connect:Express for UNIX (CVE-2015-3197)

Summary

OpenSSL vulnerabilities were disclosed on January 28, 2016 by the OpenSSL Project. OpenSSL is used by IBM Sterling Connect:Express for UNIX. IBM Sterling Connect:Express for UNIX has addressed the applicable CVEs.

Vulnerability Details

CVEID: CVE-2015-3197

DESCRIPTION: OpenSSL could allow a remote attacker to conduct man-in-the-middle attacks, caused by an error related to the negotiation of disabled SSLv2 ciphers by malicious SSL/TLS clients. An attacker could exploit this vulnerability to conduct man-in-the-middle attacks.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/110235 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

Affected Products and Versions

IBM Sterling Connect:Express for UNIX 1.4.6
- All versions prior to 1.4.6.1 iFix 146-113

IBM Sterling Connect:Express for UNIX 1.5.0.12
- All versions prior to 1.5.0.12 iFix 150-1206

Remediation/Fixes

VRMF

| Remediation
—|—
1.4.6| Please contact your local IBM Remote Technical Support Center to request Connect:Express 1.4.6.1 iFix 146-114
1.5.0.12| Apply 1.5.0.12 iFix 150-13, available on Fix Central

Workarounds and Mitigations

None, fix must be applied