Security Bulletin: GSKit SSL negotiation vulnerability in Tivoli Access Manager for e-business (CVE-2013-6329)

Security Bulletin


Summary

A vulnerability has been identified in the GSKit component utilized by Tivoli Access Manager for e-business (TAM). A specially crafted SSL message can cause the TAM server component using GSKit to crash. Remediation for the issue consists of upgrading affected GSKit following the instructions at the end of this bulletin.

Vulnerability Details

CVE ID:
CVE-2013-6329


DESCRIPTION:
TAM uses GSKit for SSL connections. The GSKit implementation is vulnerable to an attack from a specially crafted SSL message. Were an attacker to construct and send such an SSL request, they could cause the TAM server process to crash. The attack does not require local network access nor does it require authentication or specialized knowledge and techniques are required. An exploit would not impact the confidentiality of information or the integrity of data, however accessibility of the system can be compromised.

CVSS:
CVSS Base Score: 7.8
CVSS Temporal Score: http://xforce.iss.net/xforce/xfdb/88939
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:C)

Affected Products

All supported Tivoli Access Manager for e-business versions are affected.

Remediation/Fixes

The following versions of GSKit contain the fix for this issue:
· GSKit version 7.0.4.47 or higher
· GSKit version 8.0.50.13 or higher

How to obtain the patched GSKit versions:

1. Download the FP or iFix listed in the Vendor Fixes table below that matches your installed Tivoli Access Manager or IBM Security Access Manager version.
2. Follow the instructions in the README to obtain and apply the appropriate GSKit fix for your product version.


Vendor Fix(es):


TAM for e-business/ISAM Version GSKit Version Interim Fix
TAM for e-business 6.0 GSKit v7 6.0.0.31-ISS-TAM-IF0031
TAM for e-business 6.1 GSKit v7 6.1.0-TIV-TAM-IF0012
TAM for e-business 6.1.1 GSKit v7 6.1.1-ISS-TAM-FP0008
TAM for e-businessISAM WGA 7.0 GSKit v8 7.0.0-ISS-WGA-FP0002

Workarounds/Mitigations

None

References:

Complete CVSS Guide
On-line Calculator V2

Change History

17 December 2013: CVSS score changed
13 December 2013: Original copy published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Note: According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Rate this page:

(0 users)Average rating

Document information


More support for:

IBM Security Access Manager for Web

Software version:

6.0, 6.1, 6.1.1, 7.0

Operating system(s):

All Platforms

Reference #:

1659837

Modified date:

2013-12-17

Translate my page

Machine Translation

Content navigation