Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Tivoli Monitoring (CVE-2015-2808)

Workarounds and Mitigations

Portal Server Workarounds

If the patches above are not installed, the following configuration changes can be made on the portal server to address the issue.

Embedded WebSphere Application Server (eWAS) Workaround:

Update the configuration for the embedded Websphere Application Server (eWAS) included as part of IBM Tivoli Monitoring portal server.

1. Ensure the portal server is running.

2. Start the TEPS/e administration console using the steps in the Starting the TEPS/e administration console section in the Administrator's Guide or follow the steps below:
Enable the TEPS/e Administration Console:.
On Windows: Select the Tivoli Enterprise Portal server from Manage Tivoli Enterprise Monitoring Services (MTEMS), right mouse click, select Advanced --> TEPS/e Administration--> Enable TEPS/e Administration

On UNIX/Linux: Run the command:
$CANDLEHOME/<interp>/iw/scripts/enableISCLite.sh true

. Enable TEPS/e Administration Console password.
On Windows: Select the Tivoli Enterprise Portal server from MTEMS, right mouse click, select Advanced --> TEPS/e Administration--> Enable TEPS/e Password

On UNIX/Linux: Run the command:
$CANDLEHOME/<interp>/iw/scripts/updateTEPSEPass.sh wasadmin <password>

. Logon to the TEPS/e Administration Console by issuing the command:
http://<teps_hostname>:15205/ibm/console.
Use "wasadmin" as the userid and type in the password set in step 3 above.

3. On the Administration Console

• Go to Security > SSL certificate and key management > SSL configurations > NodeDefaultSSLSettings > Quality of protection (QoP)
• In the "Cipher suites" select the following ciphers from "Select ciphers" box and remove them with the "<< Remove" button.
• SSL_RSA_WITH_RC4_128_MD5
• SSL_RSA_WITH_RC4_128_SHA
• SSL_DHE_DSS_WITH_RC4_128_SHA
• Apply/Save.

Portal Server Communication with Portal Clients Workaround:

A configuration change is required when the portal server is configured to use the SSL over IIOP protocol. SSL over IIOP is being used if both conditions below are true:

• HTTPS is not being used
• applet.html file does not have the tep.connection.protocol=http or https AND
• tep.jnlp file does not have tep.connection.protocol=https
• the KFW_INTERFACE_cnps_SSL is set to "Y" in the portal server environment file (Windows: kfwenv, UNIX/Linux: cq.config)

Edit the portal server configuration file:
Windows: <install_dir>/CNPS/KFWENV
Linux/AIX: <install_dir>/config/cq.ini

Add/modify the following variable:
ITM version 6.30 through 6.30 FP4:

KFW_ORBPARM=-Dvbroker.security.server.socket.enabledProtocols=TLS_Version_1_0_Only -Dvbroker.security.cipherList=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_DES_CBC_SHA,TLS_DHE_RSA_
WITH_DES_CBC_SHA,TLS_RSA_WITH_DES_CBC_SHA

ITM version 620 through 6.23 FP5:
KFW_ORBPARM=-Dvbroker.security.cipherList=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_DES_CBC_SHA,TLS_DHE_RSA_
WITH_DES_CBC_SHA,TLS_RSA_WITH_DES_CBC_SHA
Stop and restart portal server for the changes to take affect.


You should verify applying this configuration change does not cause any compatibility issues. Not disabling the RC4 stream cipher will expose yourself to the attack described above. IBM recommends that you review your entire environment to identify other areas where you have enabled the RC4 stream cipher and take appropriate mitigation and remediation actions.