Security Bulletin
Summary
The RC4 “Bar Mitzvah” Attack for SSL/TLS affects Tivoli Storage Productivity Center.
Vulnerability Details
- CVEID: CVE-2015-2808
DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this vulnerability to remotely expose account credentials without requiring an active man-in-the-middle session. Successful exploitation could allow an attacker to retrieve credit card data or other sensitive information. This vulnerability is commonly referred to as "Bar Mitzvah Attack".
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101851 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Affected Products and Versions
IBM Spectrum Control 5.2.8 through 5.2.9 (only for upgrade)
Tivoli Storage Productivity Center 5.2.5.1 through 5.2.7 (only for upgrade)
Tivoli Storage Productivity Center 5.2.0 through 5.2.5
Tivoli Storage Productivity Center 5.1.0 through 5.1.1.6
Tivoli Storage Productivity Center 4.2.0 through 4.2.2.191
Tivoli Storage Productivity Center 4.1.x
TotalStorage Productivity Center 3.3.x
The versions listed above apply to all licensed offerings of Tivoli Storage Productivity Center, including IBM SmartCloud Virtual Storage Center Storage Analytics Engine.
System Storage Productivity Center is affected if it has one of the versions listed above installed on it.
Remediation/Fixes
The solution is to apply an appropriate Tivoli Storage Productivity Center fix maintenance for each named product as soon as practicable. See Latest Downloads for links to the fixes.
It is always recommended to have a current backup before applying any upgrade procedure.
| Affected Version | APAR | Fixed Version | Availability |
| 5.2.x | IT08318 | 5.2.5.1 See important additional steps for APAR IT15332. | April 2015 |
| 5.1.x | IT08318 | 5.1.1.7 | April 2015 |
| 4.2.2.x | IT08539 | 4.2.2.195 (FP9) | May 2015 |
Additional steps for Tivoli Storage Productivity Center 5.1.x and 5.2.x
| Important: For Tivoli Storage Productivity Center 5.2.5.1 through 5.2.7 and IBM Spectrum Control 5.2.8 through 5.2.9 that have been upgraded from an earlier version, verify that the file RC4_ENABLE does not exist in the Data directory. If it exists, it must be deleted and the Data server restarted. This has been resolved with the fix for APAR IT15332 in IBM Spectrum Control 5.2.10. Example: IBM\TPC\Data\RC4_ENABLE |
The following steps will complete the configuration of WebSphere Application server to remove the RC4 cipher from the default enabledCiphers.
From a command window:
- cd "C:\Program Files\IBM\TPC\ewas\profiles\WebServerProfile\bin"
- wsadmin.bat -connType NONE -c "$AdminTask modifySSLConfig {-alias NodeDefaultSSLSettings -scopeName (cell):WebServerCell:(node):WebServerNode -securityLevel HIGH -enabledCiphers {SSL_RSA_WITH_3DES_EDE_CBC_SHA SSL_RSA_WITH_AES_128_CBC_SHA}}"
Expected output:
"WASX7357I: By request, this scripting client is not connected to any server process. Certain configuration and application operations will be available in local mode."
If the output instead indicates an error, check for typos. If the command completed successfully:
- Stop the TPCWebServer
<TPC install dir>/scripts/stopTPCWeb.bat
or
Windows Services panel "IBM WebSphere Application Server v8.0 - TPCWebServer" - Restart the TPCWebServer
<TPC install dir>/scripts/startTPCWeb.bat
or
Windows Services panel "IBM WebSphere Application Server v8.0 - TPCWebServer"
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
Important Note
IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.
References
Acknowledgement
None
Change History
04 August 2016: Added APAR IT15332 reference.
10 August 2015: Updated for additional steps for the TPCWebServer.
07 May 2015: Updated for TPC 4.2.x
01 May 2015: Updated for TPC 5.1.x
22 April 2015: Original Version Published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
22 February 2022
UID
swg21883158