Security Bulletin
Summary
OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. OpenSSL is used by IBM Rational ClearCase. Rational ClearCase has addressed the applicable CVEs.
Vulnerability Details
CVEID: CVE-2015-0209
DESCRIPTION: OpenSSL could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free error in the d2i_ECPrivateKey or EVP_PKCS82PKEY function. An attacker could exploit this vulnerability to corrupt memory and execute arbitrary code on the system and cause a denial of service.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101674 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVEID: CVE-2015-0286
DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an error in the ASN1_TYPE_cmp function when attempting to compare ASN.1 boolean types. An attacker could exploit this vulnerability to crash any certificate verification operation and cause a denial of service.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101666 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVEID: CVE-2015-0288
DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an error in the X509_to_X509_REQ function. An attacker could exploit this vulnerability to trigger a NULL pointer dereference.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101675 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVEID: CVE-2015-0293
DESCRIPTION: OpenSSL is vulnerable to a denial of service. By sending a specially-crafted SSLv2 CLIENT-MASTER-KEY message, a remote attacker could exploit this vulnerability to trigger an assertion.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101671 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Affected Products and Versions
IBM Rational ClearCase versions:
Version | Status |
8.0.1 through 8.0.1.7 | Affected |
8.0 through 8.0.0.14 | Affected |
7.1.2 through 7.1.2.17 | Affected |
Not all deployments of Rational ClearCase use OpenSSL in a way that is affected by these vulnerabilities.
You are vulnerable if your use of Rational ClearCase includes any of these configurations:
- You use the base ClearCase/ClearQuest V2 (perl-based) integration client on any platform, configured to use SSL to communicate with a ClearQuest server.
- You use the UCM/ClearQuest integration on UNIX/Linux clients, configured to use SSL to communicate with a ClearQuest server.
Note: Windows clients using the UCM/ClearQuest integration are not vulnerable.
- You use the Change Management Integration on UNIX/Linux clients, configured to use SSL to communicate with a change management server.
Note: Windows clients using the CMI integration are not vulnerable.
- You use ratlperl, ccperl, or cqperl to run your own perl scripts, and those scripts use SSL connections. In this situation, you should review all the fixes provided by the OpenSSL project to see which ones apply to your use of OpenSSL. See the references link below.
Remediation/Fixes
The solution is to update to the latest fix pack. This fix pack includes OpenSSL 1.0.1m.
Affected Versions | Applying the fix |
8.0.1 through 8.0.1.7 | Install Rational ClearCase Fix Pack 8 (8.0.1.8) for 8.0.1 |
8.0 through 8.0.0.14 | Install Rational ClearCase Fix Pack 15 (8.0.0.15) for 8.0 |
7.1.2 through 7.1.2.17 7.1.1.x (all fix packs) 7.1.0.x (all fix packs) | Customers on extended support contracts should install Rational ClearCase Fix Pack 18 (7.1.2.18) for 7.1.2 |
You should verify applying this fix does not cause any compatibility issues.
For unsupported versions, IBM recommends upgrading to a fixed, supported version/release/platform of the product.
Workarounds and Mitigations
Disable the integrations and any customized defined use of ratlperl, ccperl, or cqperl with SSL until you apply the fixes listed above.
Get Notified about Future Security Bulletins
Important Note
IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.
References
Acknowledgement
None
Change History
* 8 May 2015: Original copy published
* 24 June 2015: fix is now included in fix packs
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Internal Use Only
The previous fixes are on the test fix portal.
The fix is included in the following TestFixes:
7.1.2.17.001
8.0.0.14.001
8.0.1.07.003
they can be installed using Installation Manager.
For 2015B, we will revise the instructions to apply a fix pack instead:
Apply a fix pack for your appropriate release of ClearCase. These fix packs include OpenSSL 1.0.1m.
7.1.1.x is also affected but we are handling communications directly with supported customers, not through a bulletin.
Was this topic helpful?
Document Information
Modified date:
10 July 2018
UID
swg21700167