IBM Support

Security Bulletin: Vulnerability with RSA Export Keys may affect IBM HTTP Server and WebSphere EDGE Caching Proxy (CVE-2015-0138)

Security Bulletin


Summary

The "FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability (CVE-2015-0138) may affect some configurations of IBM HTTP Server for WebSphere Application Server and IBM WebSphere EDGE caching proxy.

Vulnerability Details

CVEID: CVE-2015-0138
DESCRIPTION:
A vulnerability in various IBM SSL/TLS implementations could allow a remote attacker to downgrade the security of certain SSL/TLS connections. An IBM SSL/TLS client implementation could accept the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. This could allow a remote attacker using man-in-the-middle techniques to facilitate brute-force decryption of TLS/SSL traffic between vulnerable clients and servers.

This vulnerability is also known as the FREAK attack.

CVSS Base Score: 4.3
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/#/vulnerabilities/100691 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Affected Products and Versions

The following IBM HTTP Server for WebSphere Application Server and WebSphere EDGE Caching Proxy Versions may be affected:

  • Version 8.5 and 8.5.5
  • Version 8
  • Version 7
  • Version 6.1

Remediation/Fixes

For affected IBM HTTP Server for WebSphere Application Server:

If you are using SSLProxyEngine ON in IBM HTTP Server and you are going to unknown servers that may still have RSA_Export ciphers enabled then you should apply an interim fix or fixpack as noted below:

For V8.5.0.0 through 8.5.5.5 Full Profile:

· Apply Interim Fix PI36417

--OR--
· Apply Fix Pack 8.5.5.6 or later.


For V8.0 through 8.0.0.10:

· Apply Interim Fix PI36417

--OR--
· Apply Fix Pack 8.0.0.11 or later.


For V7.0.0.0 through 7.0.0.37:

· Apply Interim Fix PI36417

--OR--
· Apply Fix Pack 7.0.0.39 or later.

For V6.1.0.0 through 6.1.0.47:
· Upgrade to Fix Pack 6.1.0.47 and then apply Interim Fix PI36417


For V6.0.0.0 through 6.0.2.43:

· Upgrade to Fix Pack 6.0.2.43 and then apply Interim Fix PI36417 from IBM Support.



If you are using an earlier unsupported release, IBM strongly recommends that you upgrade.

Workarounds and Mitigations

For IBM HTTP Server Version 7.0.0.37 and later, IBM HTTP Version 8, IBM HTTP Version 8.5.x:

These versions and fix packs disable RSA_EXPORT ciphers by default and is unaffected. If you have overridden the default TLS ciphers with the 'SSLCipherSpec' directive (see parameters below), those RSA_EXPORT ciphers should be removed:

  • Ciphers specified by name and containing the word 'EXPORT' in their names.
  • Ciphers specified by 2-digit code: 33, 36, 62, 64, 24, 22

For IBM HTTP Server Version 7.0.0.0 through 7.0.0.35 and IBM HTTP Server Versions 6.1 and earlier:
These versions and fix packs include all available ciphers by default and is affected by this vulnerability in the absence of explicit configuration restricting configured ciphers. For each httpd.conf context containing 'SSLEnable', ensure the following criteria is met:
  • Ensure at least 1 SSLCipherSpec directive is set in the same context as SSLEnable by using at least one of these strong ciphers:
    • SSLCipherSpec TLS_RSA_WITH_AES_128_CBC_SHA
    • SSLCipherSpec TLS_RSA_WITH_AES_256_CBC_SHA
    • SSLCipherSpec SSL_RSA_WITH_3DES_EDE_CBC_SHA
  • Ensure none of the following ciphers are specified, if specified, then remove them
    • Ciphers specified by name and containing the word 'EXPORT' in their names.
    • Ciphers specified by 2-digit code: 33, 36, 62, 64, 24, 22


For any outbound connections, IBM Recommends that any servers that IBM HTTP Server is connecting to needs to ensure that RSA_EXPORT Ciphers are also disabled. Features of IBM HTTP Server that make outbound HTTPS connections require the configuration directive 'SSLProxyEngine ON' and additionally require directives such as 'ProxyPass, ProxyPassMatch, and RewriteRule with the [P] flag'. Related functionality exists in the WebSphere Application Server WebServer Plug-in.

For IBM WebSphere EDGE Caching proxy Version 8.0 and later:

These versions and fix packs disable RSA_EXPORT ciphers by default and is unaffected. If you have overridden the default TLS ciphers with these 'V3CipherSpecs', 'TLSV11CipherSpecs' or 'TLSV12CipherSpecs' directive (see parameters below), those RSA_EXPORT ciphers should be removed:
  • Ciphers specified by name and containing the word 'EXPORT' in their names.
  • Ciphers specified by 2-digit code: 03, 06, 62, 64

For IBM WebSphere EDGE Caching Proxy Versions 7.0 and earlier:
These versions and fix packs include '0A, 09, 05, 06, 64, 62, 04, 03, 02, 01, 00' ciphers by default and is affected by this vulnerability in the absence of explicit configuration restricting configured ciphers.

Ensure none of the following ciphers are specified, if specified, then remove them
  • Ciphers specified by name and containing the word 'EXPORT' in their names.
  • Ciphers specified by 2-digit code: 33, 36, 62, 64, 24, 22

In these releases, the following ciphers are the strongest supported:
  • TLS_RSA_WITH_AES_128_CBC_SHA (2F)
  • TLS_RSA_WITH_AES_256_CBC_SHA (35)

For any outbound connections, IBM Recommends that any servers that IBM WebSphere EDGE Caching proxy is connecting to needs to ensure that RSA_EXPORT Ciphers are also disabled.

Get Notified about Future Security Bulletins

References

Off

Acknowledgement

CVE-2015-0138 was reported to IBM by Karthikeyan Bhargavan of the PROSECCO team at INRIA .

Change History

10 March 2015: original document published
17 March 2015: updated version 7 fix packs that are affected
03 April 2015: added ifix links
15 April 2015: added EDGE Caching proxy directives
29 April 2015: updated EDGE Caching proxy with strongest supported

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SSEQTJ","label":"IBM HTTP Server"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"SSL","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"8.5.5;8.5;8.0;7.0;6.1","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Edge Component","Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
07 September 2022

UID

swg21698959