IBM Support

Security Bulletin: Vulnerability in OpenSSL affects AIX (CVE-2018-0737)

Security Bulletin


Summary

There is a vulnerability in OpenSSL used by AIX.

Vulnerability Details

CVEID: CVE-2018-0737
DESCRIPTION: The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key.
CVSS Base Score: 3.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/141679 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

AIX 5.3, 6.1, 7.1, 7.2
VIOS 2.2.x

The following fileset levels are vulnerable:
       
key_fileset = osrcaix

Fileset         Lower Level    Upper Level    KEY
------------------------------------------------------
openssl.base    1.0.2.500      1.0.2.1300     key_w_fs
openssl.base    20.13.102.1000 20.13.102.1300 key_w_fs

Note:
A. 0.9.8, 1.0.1 OpenSSL versions are out-of-support. Customers are  advised to upgrade to currently supported OpenSSL 1.0.2 version.
B. Latest level of OpenSSL fileset is available from the web download site:

https://www14.software.ibm.com/webapp/iwm/web/reg/download.do?source=ai…
 
To find out whether the affected filesets are installed on your systems, refer to the lslpp command found in the AIX user's guide.

Example:  lslpp -L | grep -i openssl.base

Remediation/Fixes

FIXES

A fix is available, and it can be downloaded from:
https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=aixbp

To extract the fixes from the tar file:

For Openssl 1.0.2 version -
zcat openssl-1.0.2.1500.tar.Z | tar xvf -

For 1.0.2 FIPS capable openssl version -
zcat openssl-20.13.102.1500.tar.Z | tar xvf -
           
IMPORTANT: If possible, it is recommended that a mksysb backup of the system be created.  Verify it is both bootable and readable before proceeding.

Note that all the previously reported security vulnerability fixes are also included in above mentioned fileset level. Please refer to the readme file (provided along with the fileset) for the complete list of vulnerabilities fixed.

To preview the fix installation:
installp -apYd . openssl

To install the fix package:
installp -aXYd . openssl
           
openssl dgst -sha1 -verify [pubkey_file] -signature [advisory_file].sig [advisory_file]
openssl dgst -sha1 -verify [pubkey_file] -signature [ifix_file].sig [ifix_file]

Published advisory OpenSSL signature file location:
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory27.asc…
https://aix.software.ibm.com/aix/efixes/security/openssl_advisory27.asc…
ftp://aix.software.ibm.com/aix/efixes/security/openssl_advisory27.asc.s…

Workarounds and Mitigations

None.

Get Notified about Future Security Bulletins

References

Off

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SWG10","label":"AIX"},"Component":"","Platform":[{"code":"PF002","label":"AIX"}],"Version":"5.3;6.1;7.1;7.2","Edition":"","Line of Business":{"code":"LOB08","label":"Cognitive Systems"}}]

Document Information

Modified date:
02 July 2018

UID

ibm10713441