Security Bulletin: IBM Content Collector for SAP Application is affected by a side channel attack vulnerability in GSKit

Summary

IBM Content Collector for SAP Applications has addressed the following vulnerability: OpenSSL which is part of GSKit Crypto, could allow a local attacker to obtain sensitive information by a side-channel attach against a system based on Intel Sandy-Bridge microarchitecture. An attacker could exploit this vulnerability to recover RSA keys.

Vulnerability Details

CVEID:CVE-2016-0702
**DESCRIPTION:*OpenSSL could allow a local attacker to obtain sensitive information, caused by a side-channel attack against a system based on the Intel Sandy-Bridge microarchitecture. An attacker could exploit this vulnerability to recover RSA keys.
CVSS Base Score: 2.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111144 for the current score
CVSS Environmental Score: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

IBM Content Collector for SAP Applications v3.0

IBM Content Collector for SAP Applications v4.0

Remediation/Fixes

Product

| VRM |Remediation
—|—|—
IBM Content Collector for SAP Applications | 3.0 | Use IBM Content Collector for SAP Applications 3.0.0.2 Interim Fix 8
IBM Content Collector for SAP Applications | 4.0 | Use IBM Content Collector for SAP Applications 4.0.0.2 Interim Fix 2

Workarounds and Mitigations

None