Security Bulletin
Summary
IBM Rational ClearQuest is vulnerable to a denial of service caused by an error in the Global Security Toolkit (GSKit) component. By initiating an SSL/TLS connection using a malformed certificate chain, a server process could hang or crash.
Vulnerability Details
Subscribe to My Notifications to be notified of important product support alerts like this.
|
CVE ID: CVE-2014-0076
Description: An attacker running a program on the same machine as where the victim is running a program could use CPU timing information to discover key information about certain kinds of binary type Elliptic Curves used in Digital signatures during signing operations. Although GSKit only generates Prime type Elliptic Curves, externally generated keys may be imported in GSKit.
CVSS Base Score: 2.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/91990
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N)
Affected Products and Versions
The IBM GSKit is used if ClearQuest is using LDAP authentication with SSL enabled.
The IBM GSKit is also used by CQWeb server for ClearQuest 8.0.0.x/8.0.1.x (all platforms) when supporting SSL connections with IBM HTTP Server version 8 or higher.
LDAP component
LDAP component (all platforms) | Status |
8.0.1.x | Affected |
8.0.0.x | Affected |
7.0.x, 7.1.0.x, 7.1.1.x, 7.1.2.x | Not affected |
CQWeb Server
CQWeb Server (all platforms) | Status |
8.0.1.x | Affected |
8.0.0.x | Affected if you use IBM HTTP Server version 8 or higher |
7.0.x, 7.1.0.x, 7.1.1.x, 7.1.2.x | Not affected |
Remediation/Fixes
The solution is to upgrade to a newer fix pack of Rational ClearQuest that has a newer GSKit component that corrects these vulnerabilities, and to update the IBM HTTP Server.
Review the information on the fixes available below:
| Affected Versions | Apply the fix to Windows clients using an integration |
| 8.0.1.x | Rational ClearQuest Fix Pack 4 (8.0.1.4) for 8.0.1 |
| 8.0.0.x | Rational ClearQuest Fix Pack 11 (8.0.0.11) for 8.0 |
Server fixes (for CQWeb server):
Install a fix to IBM HTTP Server if you use SSL on your WAN server and you use IBM HTTP Server version 8 or higher. You need the fix for APAR PI19700. Consult IHS security bulletin 1676092 for the details of the fix.
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Acknowledgement
None
Change History
* 25 June 2014: Original copy published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Internal Use Only
IBM20140507-1735-14 Advisory DB ID = 1731
Was this topic helpful?
Document Information
Modified date:
16 June 2018
UID
swg21675306