IBM Support

Security Bulletin: Vulnerabilities in OpenSSL affect Tivoli Storage FlashCopy Manager Unix (CVE-2016-6303, CVE-2016-2182, CVE-2016-2177, CVE-2016-2183, CVE-2016-6309, CVE-2016-7052, CVE-2016-2178, CVE-2016-6306)

Security Bulletin


Summary

OpenSSL vulnerabilities were disclosed on September 22 and 26, 2016 by the OpenSSL Project. OpenSSL used by Tivoli Storage FlashCopy Manager (IBM Spectrum Protect Snapshot) Unix has addressed the applicable CVEs.

Vulnerability Details

CVEID: CVE-2016-6303
DESCRIPTION:
OpenSSL is vulnerable to a denial of service, caused by an integer overflow in the MDC2_Update function. By using unknown attack vectors, a remote attacker could exploit this vulnerability to trigger an out-of-bounds write and cause the application to crash.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/117023 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-2182
DESCRIPTION:
OpenSSL is vulnerable to a denial of service, caused by an out-of-bounds write in the TS_OBJ_print_bio function in crypto/bn/bn_print.c. A remote attacker could exploit this vulnerability using a specially crafted value to cause the application to crash.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/116342 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-2177
DESCRIPTION:
OpenSSL is vulnerable to a denial of service, caused by the incorrect use of pointer arithmetic for heap-buffer boundary checks. By leveraging unexpected malloc behavior, a remote attacker could exploit this vulnerability to trigger an integer overflow and cause the application to crash.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/113890 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2016-2183
DESCRIPTION:
OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a man-in-the-middle attack could exploit this vulnerability to recover the plaintext data and obtain sensitive information. This vulnerability is known as the SWEET32 Birthday attack.
CVSS Base Score: 3.7
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/116337 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2016-6309
DESCRIPTION:
OpenSSL is vulnerable to a denial of service, caused by a use-after-free when handling message sizes. By sending an overly large message, a remote attacker could exploit this vulnerability to possibly execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/117148 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-7052
DESCRIPTION:
OpenSSL is vulnerable to a denial of service, caused by a missing CRL sanity check. By attempting to use CRLs, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/117149 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-2178
DESCRIPTION:
OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DSA implementation that allows the following of a non-constant time codepath for certain operations. An attacker could exploit this vulnerability using a cache-timing attack to recover the private DSA key.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/113889 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2016-6306
DESCRIPTION:
OpenSSL is vulnerable to a denial of service, caused by missing message length checks when parsing certificates. A remote authenticated attacker could exploit this vulnerability to trigger an out-of-bounds read and cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/117112 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

The following IBM Tivoli Storage FlashCopy Manager (IBM Spectrum Protect Snapshot) components and levels are affected by the OpenSSL vulnerabilities when used with a DS8000, SVC, NetApp, or IBM N-series storage device:

FlashCopy Manager for Unix and Linux, FlashCopy Manager for DB2, FlashCopy Manager for Oracle, FlashCopy Manager for Oracle with SAP environments, and FlashCopy Manager for Custom Applications at these levels:
- 4.1.0.0 through 4.1.6.0 (AIX and Linux)
- 4.1.0.0 throught 4.1.1.4 (HP_UX and Solaris)
- 3.2.0.0 through 3.2.0.8
- 3.1.0.0 through 3.1.0.2

FlashCopy Manager is vulnerable only when it initiates and maintains a communication session with a DS8000, SVC, NetApp, or IBM N series storage device. The vulnerability does not exist during communication sessions with other types of storage devices or when an external program attempts to initiate an OpenSSL session with FlashCopy Manager.

Remediation/Fixes

Tivoli Storage FlashCopy Manager for Unix Release

First Fixing VRMF LevelPlatformLink to Fix / Fix Availability Target
4.1 4.1.6.1AIX
Linux
http://www.ibm.com/support/docview.wss?uid=swg24043441

4.1.1.5HP-UX
Solaris
http://www.ibm.com/support/docview.wss?uid=swg24043442
3.2 3.2.0.9AIX
HP-UX
Linux
Solaris
http://www.ibm.com/support/docview.wss?uid=swg24043429
3.1 3.1.0.3AIX
HP-UX
Linux
Solaris
http://www.ibm.com/support/docview.wss?uid=swg24043428

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

References

Off

Change History

22 March 2017 - Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SS36V9","label":"Tivoli Storage FlashCopy Manager"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Component":"--","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF010","label":"HP-UX"}],"Version":"3.1;3.2;4.1","Edition":"All Editions","Line of Business":{"code":"LOB26","label":"Storage"}}]

Document Information

Modified date:
17 June 2018

UID

swg22000209