IBM Support

Security Bulletin: IBM Worklight is affected by a vulnerability in OpenSSL (CVE-2014-0160)

Security Bulletin


Summary

A security vulnerability has been discovered in OpenSSL.

Vulnerability Details

CVE-ID: CVE-2014-0160

DESCRIPTION: OpenSSL might allow a remote attacker to obtain sensitive information, which is caused by an error in the TLS/DTLS heartbeat functionality. An attacker might exploit this vulnerability to expose 64K of private memory and retrieve secret keys. This vulnerability can be remotely exploited; authentication is not required and the exploit is not complex. An exploit can only partially affect the confidentially, but not the integrity or availability.


CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92322
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)


Attention: We strongly encourage you to take action as soon as possible as potential implications to your environment might be more serious than indicated by the CVSS score.

Affected Products and Versions

This issue affects the following products

  • IBM Worklight Consumer Edition Versions 6.1.0.0 and 6.1.0 Fix Pack 1

  • IBM Worklight Enterprise Edition Versions 6.1.0.0 and 6.1.0 Fix Pack 1


IBM Worklight versions 6.1.0.0 and 6.1.0.1

Remediation/Fixes

The interim fixes are available through the following links:

The fix is also targeted for a future IBM Worklight 6.1 fix pack.


The impact and required actions for this vulnerability are different depending on if the vulnerable OpenSSL is used on the client side or server side. The following information describes the client side and server side impact for IBM Worklight:

  • Client side:
    The IBM Worklight 6.1 client uses OpenSSL only when the optional FIPS 140-2 data-in-motion feature is selected. In this scenario, if the Worklight client connects to a malicious server, the malicious server might exploit the Heartbleed vulnerability to read data from the client application process memory. This data might include client credentials, business data, or both.


    After applying the fix and rebuilding and deploying the client applications, users of the impacted applications need to reset the user credentials that might have been exposed.

  • Server side:

    • The IBM Worklight server does not use OpenSSL. The termination of SSL connections coming into the server is handled by the application server (WebSphere Application Server, WebSphere Application Server Liberty profile or Apache Tomcat). WebSphere Application Server and the WebSphere Application Server Liberty profile are not vulnerable to this issue.


    Note: The Apache Tomcat server might be vulnerable. If you are using Apache Tomcat as your application server, you should verify if you Apache Tomcat installation is vulnerable. If it is vulnerable, apply the appropriate fix from the Apache Tomcat project.


    If your Apache Tomcat installation is vulnerable, after applying the fix, additional instructions are needed for CVE-2014-0160. Complete the following steps:
    1. Replace your SSL Certificates.
      You need to revoke existing SSL certificates and reissue new certificates. You need to be sure not to generate the new certificates using the old private key and create a new private key (for example using "openssl genrsa") and use that new private key to create the new certificate signing request (CSR).

    2. Reset the user credentials
      Users of network-facing applications that are protected by a vulnerable version of OpenSSL should be forced to reset their passwords. You should revoke any authentication or session-related cookies that were set prior to the time OpenSSL was upgraded and force the user to re-authenticate.

Attention: Your environment might require additional fixes for other products, including non-IBM products. Replace the SSL certificates and reset the user credentials after applying the necessary fixes to your environment.

Workarounds and Mitigations

You can use the following work arounds:

  • Client side:
    For IBM Worklight 6.1 client applications that are using the optional FIPS 140-2 data-in-motion feature, the only mitigation is to rebuild the applications to not use the optional FIPS 140-2 feature.

  • Server side:

    • None

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Off

WebSphere Application Server Flash for CVE-2014-0160
OpenSSL Project vulnerability website

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

* 18 April 2014: Original copy published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SSZH4A","label":"IBM Worklight"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Security","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF014","label":"iOS"},{"code":"PF003","label":"Android"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"6.1.0.1;6.1","Edition":"Consumer;Enterprise","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
17 June 2018

UID

swg21670864

Page Feedback