Security Bulletin: Vulnerabilities in OpenSSL affect IBM Security Network Controller (CVE-2015-3193, CVE-2015-3194, CVE-2015-3195, CVE-2015-3196, CVE-2015-1794)

Summary

OpenSSL vulnerabilities were disclosed on December 3, 2015 by the OpenSSL Project. OpenSSL is used by IBM Security Network Controller . IBM Security Network Controller has addressed the applicable CVEs.

Vulnerability Details

CVEID: CVE-2015-3193**
DESCRIPTION:** OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the x86_64 Montgomery squaring procedure. An attacker with online access to an unpatched system could exploit this vulnerability to obtain private key information.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/108502 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2015-3194**
DESCRIPTION:** OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference when verifying certificates via a malformed routine. An attacker could exploit this vulnerability using signature verification routines with an absent PSS parameter to cause any certificate verification operation to crash.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/108503 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2015-3195**
DESCRIPTION:** OpenSSL could allow a remote attacker to obtain sensitive information, caused by a memory leak in a malformed X509_ATTRIBUTE structure. An attacker could exploit this vulnerability to obtain CMS data and other sensitive information.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/108504 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2015-3196**
DESCRIPTION:** OpenSSL is vulnerable to a denial of service, caused by a race condition when PSK identity hints are received by a multi-threaded client and the SSL_CTX structure is updated with the incorrect value. An attacker could exploit this vulnerability to possibly corrupt memory and cause a denial of service.
CVSS Base Score: 3.7
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/108505 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2015-1794**
DESCRIPTION:** OpenSSL is vulnerable to a denial of service, caused by an error when a client receives a ServerKeyExchange for an anonymous DH ciphersuite with the value of p set to 0. An attacker could exploit this vulnerability to trigger a segfault and cause a denial of service.
CVSS Base Score: 3.7
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/108539 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Products:
IBM Security Network Controller

Firmware versions:
1.0.913, 1.0.1209, 1.0.1768, 1.0.3350M, 1.0.3352M, 1.0.3361, 1.0.3361M, 1.0.3376, 1.0.3376M, 1.0.3379, 1.0.3379M, 1.0.3381, 1.0.3381M, 1.0.3387, 1.0.3387M, 1.0.3394, 1.0.3394M

Remediation/Fixes

Product

| VRMF| Remediation/First Fix
—|—|—
IBM Security Network Controller| 1.0.X| Proventia NSC Update 13 (fw 1.0.3399M) ** IBM Security Network Controller**| 1.0.X| Proventia NSC Update 13 (fw 1.0.3399)

for IBM Security Network Controller products at Firmware versions:

NSC - 1.0.913, 1.0.1209, 1.0.1768, 1.0.3350M, 1.0.3352M, 1.0.3361, 1.0.3361M, 1.0.3376, 1.0.3376M, 1.0.3379, 1.0.3379M, 1.0.3381, 1.0.3381M, 1.0.3387, 1.0.3387M, 1.0.3394, and 1.0.3394

IBM recommends upgrading to 1.0.3399/1.0.3399M depending on currnet firmware installed. Update 1.0.3399M and 1.0.3399 are the supported firmware release of the product.

Note: A fix for CVE-2015-3196 was provided in OpenSSL versions 1.0.1p and 1.0.2d and was previously addressed by IBM Security Network Controller

Workarounds and Mitigations

none