Security Bulletin
Summary
SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 is enabled in IBM Worklight.
Vulnerability Details
CVE-ID: CVE-2014-3566
DESCRIPTION: Product could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and access the plaintext of encrypted connections.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97013 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Affected Products and Versions
- IBM Mobile Foundation and IBM Worklight Consumer Edition Versions 5.0.5.0 and 5.0.5.1
- IBM Mobile Foundation and IBM Worklight Enterprise Edition Versions 5.0.5.0 and 5.0.5.1
- IBM Mobile Foundation and IBM Worklight Consumer Edition Versions 5.0.6.0, 5.0.6.1 and 5.0.6.2
- IBM Mobile Foundation and IBM Worklight Enterprise Edition Versions 5.0.6.0, 5.0.6.1 and 5.0.6.2
- IBM Mobile Foundation and IBM Worklight Consumer Edition Versions 6.0.0.0, 6.0.0.1 and 6.0.0.2
- IBM Mobile Foundation and IBM Worklight Enterprise Edition Versions 6.0.0.0, 6.0.0.1 and 6.0.0.2
- IBM Worklight Consumer Edition Versions 6.1.0.0, 6.1.0.1 and 6.1.0.2
- IBM Worklight Enterprise Edition Versions 6.1.0.0, 6.1.0.1 and 6.1.0.2
- IBM Worklight Foundation Consumer Edition Version 6.2.0.0 and 6.2.0.1
- IBM Worklight Foundation Enterprise Edition Version 6.2.0.0 and 6.2.0.1
Remediation/Fixes
Download the latest interim fix for your product and version:
V5.0.5: IBM Worklight Consumer Edition, IBM Worklight Enterprise Edition, IBM Mobile Foundation Consumer Edition, IBM Mobile Foundation Enterprise Edition
V5.0.6: IBM Worklight Consumer Edition, IBM Worklight Enterprise Edition, IBM Mobile Foundation Consumer Edition, IBM Mobile Foundation Enterprise Edition
V6.0.x: IBM Worklight Consumer Edition, IBM Worklight Enterprise Edition, IBM Mobile Foundation Consumer Edition, IBM Mobile Foundation Enterprise Edition
V6.1.x: IBM Worklight Consumer Edition, IBM Worklight Enterprise Edition
V6.2.x: IBM Worklight Foundation Consumer Edition, IBM Worklight Foundation Enterprise Edition
The interim fixes above will disable SSLv3 by default in the Worklight server. In addition, newer versions of the IBM JRE and Oracle JRE disable SSLv3 by default. If you need to change that behavior so that SSLv3 is enabled, then there are new properties to re-enable SSLv3. Set the properties as described in the Information Center for the Java edition you are using:
- To re-enable SSLv3 in the Worklight server, set this Java system property:
-Dcom.ibm.worklight.disableSSLv3=false
Also set one of the following depending on the JRE you are using (IBM or Oracle):
- To re-enable SSLv3 in the IBM JRE, set this Java system property:
-Dcom.ibm.jsse2.disableSSLv3=false
To re-enable SSLv3 in the Oracle JRE, edit the file <JRE_HOME>/lib/security/java.security, and change the value of the property jdk.tls.disabledAlgorithms.
For reference, see release notes of version 1.7.0_75 or release notes of version 1.7.0_76.
The interim fixes will also disable SSLv3 by default in the acdeploytool for Application Center. If you need to change that behavior so that SSLv3 is enabled, then there is a new option to acdeploytool to re-enable SSLv3. For example:
- Windows command line:
acdeploytool.bat -enableSSLv3 ...
Unix command line:
acdeploytool.sh -enableSSLv3 ...
Ant script:
<uploadapps enableSSLv3="true" ...>
After applying the appropriate fix, additional instructions are needed for CVE-2014-3566. Follow the guidance below based on the type of application server used.
For WebSphere Application Server, complete the steps described in the following security bulletin:
Security Bulletin: Vulnerability in SSLv3 affects IBM WebSphere Application Server (CVE-2014-3566)
For Apache Tomcat, complete the steps described in the following advisory:
https://access.redhat.com/solutions/1232233
IBM recommends that you review your entire environment to identify areas that enable the SSLv3 protocol and take appropriate mitigation and remediation actions. The most immediate mitigation action that can be taken is disabling SSLv3. You should verify disabling SSLv3 does not cause any compatibility issues.
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Security Bulletin: Vulnerability in SSLv3 affects IBM Installation Manager (CVE-2014-3566)
IBM SDK, Java Technology Edition fixes to mitigate against the POODLE security vulnerability (CVE-2014-3566)
Disabling SSLv3 and SSLv2 in Tomcat and JBoss Web
Instructions to disable SSL v3.0 in Oracle JDK and JRE
Change History
* 24 Fenruary 2015: Updated with Oracle JRE fix information
* 21 November 2014: Original copy published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
17 June 2018
UID
swg21690504