Security Bulletin
Summary
There is a vulnerability in OpenSSL used by AIX.
Vulnerability Details
CVEID: CVE-2018-0737
DESCRIPTION: The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key.
CVSS Base Score: 3.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/141679 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Affected Products and Versions
AIX 5.3, 6.1, 7.1, 7.2
VIOS 2.2.x
The following fileset levels are vulnerable:
key_fileset = osrcaix
Fileset Lower Level Upper Level KEY
------------------------------------------------------
openssl.base 1.0.2.500 1.0.2.1300 key_w_fs
openssl.base 20.13.102.1000 20.13.102.1300 key_w_fs
Note:
A. 0.9.8, 1.0.1 OpenSSL versions are out-of-support. Customers are advised to upgrade to currently supported OpenSSL 1.0.2 version.
B. Latest level of OpenSSL fileset is available from the web download site:
https://www14.software.ibm.com/webapp/iwm/web/reg/download.do?source=ai…
To find out whether the affected filesets are installed on your systems, refer to the lslpp command found in the AIX user's guide.
Example: lslpp -L | grep -i openssl.base
Remediation/Fixes
FIXES
A fix is available, and it can be downloaded from:
https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=aixbp
To extract the fixes from the tar file:
For Openssl 1.0.2 version -
zcat openssl-1.0.2.1500.tar.Z | tar xvf -
For 1.0.2 FIPS capable openssl version -
zcat openssl-20.13.102.1500.tar.Z | tar xvf -
IMPORTANT: If possible, it is recommended that a mksysb backup of the system be created. Verify it is both bootable and readable before proceeding.
Note that all the previously reported security vulnerability fixes are also included in above mentioned fileset level. Please refer to the readme file (provided along with the fileset) for the complete list of vulnerabilities fixed.
To preview the fix installation:
installp -apYd . openssl
To install the fix package:
installp -aXYd . openssl
openssl dgst -sha1 -verify [pubkey_file] -signature [advisory_file].sig [advisory_file]
openssl dgst -sha1 -verify [pubkey_file] -signature [ifix_file].sig [ifix_file]
Published advisory OpenSSL signature file location:
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory27.asc…
https://aix.software.ibm.com/aix/efixes/security/openssl_advisory27.asc…
ftp://aix.software.ibm.com/aix/efixes/security/openssl_advisory27.asc.s…
Workarounds and Mitigations
None.
Get Notified about Future Security Bulletins
References
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
02 July 2018
UID
ibm10713441