Security Bulletin: Vulnerability in RC4 stream cipher affects OpenPages GRC Platform with Application Server (CVE-2015-2808)

Workarounds and Mitigations

The embedded application server can be reconfigured to only accept known good ciphers and avoid this issue. Please note that this remediation changes the list of cipher suites accepted by the application server. As a result, there is a chance SSL connectivity issues could arise in your environment . While no issues have been found in internal testing, we encourage you to test this configuration on a test system in your environment prior to using it in production.

Mitigation Steps:

1. Stop all servers. For details on stopping services, see the “Starting and Stopping Servers” chapter in the IBM® OpenPages® GRC Platform Administrator’s Guide.
2. Log into the Windows console of the primary application server as an administrator.
3. Launch regedit.exe
4. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\OpenPagesAdminServer\Parameters
5. Right-click on the Parameters key and select Export.
6. Create a backup directory (you will be repeating this export with other keys).
7. Save the export as OpenPagesAdminServer
8. Select the current value for CmdLine
9. Paste it into a text editor such as Notepad
10. Move to the very end of the string and you will find the text "weblogic.Server"
11. Insert the string "-Dweblogic.security.SSL.protocolVersion=TLS1" before "weblogic.Server".
    
    For example, change:
    
    -Djava.security.policy="C:\oracle\middleware\wlserver_10.3\server\lib\weblogic.policy" weblogic.Server
    
    to:
    
    -Djava.security.policy="C:\oracle\middleware\wlserver_10.3\server\lib\weblogic.policy" -Dweblogic.security.SSL.protocolVersion=TLS1 weblogic.Server
    
    
12. Copy the string from your editor and use it to replace the current contents of the CmdLine setting.
13. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\OpenPagesServer1\Parameters
14. Right-click on the Parameters key and select Export.
15. Save the export as OpenPagesServer1 in the backup directory
16. Repeat steps 8 through 12 for this key.
17. If you have additional node installed (for example OpenPagesServer2) repeat the process of exporting and adding "-Dweblogic.security.SSL.protocolVersion=TLS1" for each node.
18. Repeat the process for the workflow servers by editing:
    - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\InterstageBPMAdminServer\Parameters
    - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\InterstageBPMCS1\Parameters
    - Any additional nodes installed (i.e. InterstageBPMCS2)
19. Close Registry Editor
20. Navigate to the file <OpenPages_Home>\OpenPagesDomain\config\config.xml
    
    
    For example:
    
    C:\OpenPages\OpenPagesDomain\config\config.xml
    
    
21. Make a backup copy of the file
22. Edit the file in Notepad of similar text editor.
23. Locate the following section:
    
    <server>
    <name>OpenPagesAdminServer</name>
    <ssl>
    <name>OpenPagesAdminServer</name>
    <enabled>true</enabled>
    
    
24. Add the following below the <enabled>true</enabled> line:
    
    
    <ciphersuite>TLS_RSA_WITH_AES_128_CBC_SHA</ciphersuite>
    <jsse-enabled>true</jsse-enabled>
    
    
25. Look further down the file for the section:
    
    
    <server>
    <name>ServerName-OpenPagesServer1</name>
    <max-message-size>2000000000</max-message-size>
    <ssl>
    <enabled>true</enabled>
    
    
26. Add the following below the <enabled>true</enabled> line:
    
    
    <ciphersuite>TLS_RSA_WITH_AES_128_CBC_SHA</ciphersuite>
    
    
27. In the same <ssl> block, add <enabled>true</enabled> just before the closing </ssl>. Your <ssl> block should now look something like the following:
    
    
    <ssl>
    <enabled>true</enabled>
    <ciphersuite>TLS_RSA_WITH_AES_128_CBC_SHA</ciphersuite>
    <listen-port>7010</listen-port>
    <server-private-key-alias>mystrongcert</server-private-key-alias>
    <server-private-key-pass-phrase-encrypted>{AES}123456abce=</server-private-key-pass-phrase-encrypted>
    <jsse-enabled>true</jsse-enabled>
    </ssl>
    
    
    
28. Make the same changes to any additional nodes you have configured. (i.e. ServerName-OpenPagesServer2)
29. Save and close config.xml
30. Navigate to the file <Fujitsu_Home>\InterstageBPM\IBPMDomain\config\config.xml
    
    
    For example:
    
    C:\Fujitsu\InterstageBPM\IBPMDomain\config\config.xml
    
    
31. Make a backup copy of the file
32. Edit the file in Notepad of similar text editor.
33. Locate the following section:
    
    <server>
    <name>AdminServer</name>
    <ssl>
    <name>AdminServer</name>
    <enabled>true</enabled>
    
    
34. Add the following below the <enabled>true</enabled> line:
    
    
    
    <ciphersuite>TLS_RSA_WITH_AES_128_CBC_SHA</ciphersuite>
    
    
35. In the same <ssl> block, add <enabled>true</enabled> just before the closing </ssl>. Your <ssl> block should now look like the following:
    
    
    <ssl>
    <enabled>true</enabled>
    <ciphersuite>TLS_RSA_WITH_AES_128_CBC_SHA</ciphersuite>
    <listen-port>49902</listen-port>
    <jsse-enabled>true</jsse-enabled>
    </ssl>
    
    
36. Look further down the file for the section:
    
    
    <server>
    <name>ServerName-InterstageBPMCS1</name>
    <max-message-size>2000000000</max-message-size>
    <ssl>
    <enabled>true</enabled>
    
    
37. Add the following below the <enabled>true</enabled> line:
    
    
    <ciphersuite>TLS_RSA_WITH_AES_128_CBC_SHA</ciphersuite>
    
    
38. In the same <ssl> block, add <enabled>true</enabled> just before the closing </ssl>. Your <ssl> block should now look something like the following:
    
    
    <ssl>
    <enabled>true</enabled>
    <ciphersuite>TLS_RSA_WITH_AES_128_CBC_SHA</ciphersuite>
    <listen-port>49952</listen-port>
    <jsse-enabled>true</jsse-enabled>
    </ssl>
    
    
    
39. Make the same changes to any additional nodes you have configured. (i.e. ServerName-InterstageBPMCS2)
40. Save and close config.xml
41. You may now restart services.
42. Once services restart, connect to the application via secure connection to validate that you can connect.