IBM Support

IT14321: A VULNERABILITY IN THE SSL COMPONENT OF IBM DATAPOWER GATEWAYS. (CVE-2015-3193, CVE-2015-3195, CVE-2015-1794)

Subscribe

You can track all active APARs for this component.

APAR status

  • Closed as program error.

Error description

  • SSL could allow a remote attacker to obtain sensitive
    information, caused by an error in the x86_64 Montgomery
    squaring procedure (CVE-2015-3193).
    SSL could allow a remote attacker to obtain sensitive
    information, caused by a memory leak in a malformed
    X509_ATTRIBUTE structure (CVE-2015-3195).
    SSL is vulnerable to a denial of service, caused by an error
    when a client receives a ServerKeyExchange for an anonymous DH
    ciphersuite (CVE-2015-1794).
    

Local fix

Problem summary

  • SSL vulnerabilities disclosed on December 3rd, 2015 include
    CVE-2015-3195, CVE-2015-3193 and CVE-2015-1794.  IBM DataPower
    Gateways releases 7.2.0.x up to 7.2.0.5 are affected by these
    CVEs.
    SSL could allow a remote attacker to obtain sensitive
    information, caused by a computation (CVE-2015-3193).
    SSL could allow a remote attacker to obtain sensitive
    information, caused by a memory leak (CVE-2015-3195).
    SSL is vulnerable to a denial of service, caused by a client
    cipher suite error (CVE-2015-1794).
    

Problem conclusion

Temporary fix

Comments

APAR Information

  • APAR number

    IT14321

  • Reported component name

    DATAPOWER

  • Reported component ID

    DP1234567

  • Reported release

    720

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-03-15

  • Closed date

    2016-05-13

  • Last modified date

    2016-05-13

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    DATAPOWER

  • Fixed component ID

    DP1234567

Applicable component levels

  • R700 PSY

       UP

  • R710 PSY

       UP

  • R720 PSY

       UP

  • R750 PSY

       UP



Document information

More support for: IBM DataPower Gateways
General

Software version: 7.2

Reference #: IT14321

Modified date: 13 May 2016