IBM Support

Security Bulletin: Vulnerability in SSLv3 affects Rational DOORS Web Access (CVE-2014-3566)

Created by Robert Carroll1 on
Published URL:
https://www.ibm.com/support/pages/node/254281
254281

Security Bulletin


Summary

SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 can be enabled in IBM Rational DOORS Web Access.

Vulnerability Details

 Subscribe to My Notifications to be notified of important product support alerts like this.
  • Follow this link for more information (requires login with your IBM ID)

CVE ID: CVE-2014-3566

Description: Product could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and access the plaintext of encrypted connections.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97013 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector:  (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Affected Products and Versions

Rational DOORS Web Access version 9.6.0.x, 9.5.2.x, 9.5.1.x, 9.5.0.x, 1.5.0.x, 1.4.0.x.

Remediation/Fixes

    None

Workarounds and Mitigations

IBM recommends that you review your entire environment to identify areas that enable the SSLv3 protocol and take appropriate mitigation and remediation actions. The most immediate mitigation action that can be taken is disabling SSLv3.

To avoid this vulnerability, configure the Apache Tomcat server.xml file in your Rational DOORS Web Access installation to disable SSLv3 and instead use TLS v1.2 or v1.1. Note that TLS v1.2 is more secure, but not all servers, clients, and browsers support this protocol. Do not use TLSv1.0.


Procedure:
  1. To access the configuration files for Rational DOORS Web Access for SSL or TLS, review the help topic Configuring Rational DOORS Web Access to use SSL or TLS for more details.

  2. In the SSL JSSE HTTP Connector section of the server.xml file, set the following values.

    For Rational DOORS Web Access versions 9.5.2.x, 9.5.1.x, 9.5.0.x, 1.5.0.x, 1.4.0.x (prior to Tomcat 6.0.39):
    <Connector port="8443" protocol="HTTP/1.1"
       maxThreads="150" clientAuth="false"
       SSLEnabled="true" scheme="https" secure="true"
           sslProtocol="TLS" protocols="TLSv1.2,TLSv1.1"/>

    For Rational DOORS Web Access versions 9.6.0.x (Tomcat 6.0.39 and later):
    <Connector port="8443" protocol="HTTP/1.1"
       maxThreads="150" clientAuth="false"
       SSLEnabled="true" scheme="https" secure="true"
           sslProtocol="TLS" sslEnabledProtocols="TLSv1.2,TLSv1.1"/>

  3. If you are using APR, use the following values:

    <Connector...
       maxThreads="200"
       enableLookups="true" disableUploadTimeout="true"
       acceptCount="100" scheme="https" secure="true"
       SSLEnabled="true"
           SSLProtocol="TLSv1"
       SSLCertificateFile="${catalina.base}/conf/localhost.crt"            
       SSLCertificateKeyFile="${catalina.base}/conf/localhost.key    " />

  4. Save and close the server.xml file.

  5. Restart the Rational DOORS Web Access server.


You can test the SSL/TLS version configuration in Tomcat by running the following commands in openssl:
openssl s_client -connect testhost:port -ssl3
  • Fails if SSLv3 is disabled.
openssl s_client -connect testhost:port -tls1
  • Returns a certificate if TLSv1 is enabled.
openssl s_client -connect testhost:port -tls1_1
  • Returns a certificate if TLSv1.1 is enabled.
openssl s_client -connect testhost:port -tls1_2
  • Returns a certificate if TLSv1.2 is enabled.

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Acknowledgement

None

Change History

* 21 October 2014: Original copy published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Internal Use Only

PSIRT Record # 2290

[{"Product":{"code":"SSYQCV","label":"IBM Engineering Requirements Management DOORS Web Access"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"General Information","Platform":[{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"1.4;1.4.0.1;1.4.0.2;1.4.0.3;1.4.0.4;1.4.0.5;1.5;1.5.0.1;9.5;9.5.0.1;9.5.1;9.5.1.1;9.5.2;9.5.2.1;9.6;9.6.0.1","Edition":"","Line of Business":{"code":"LOB59","label":"Sustainability Software"}},{"Product":{"code":"SSKR2T","label":"IBM Engineering Requirements Management DOORS"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"General Information","Platform":[{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"1.4.0.4;1.4.0.5;1.5;1.5.0.1;9.5;9.5.0.1;9.5.1;9.5.1.1;9.5.2;9.5.2.1;9.6;9.6.0.1","Edition":"Web Access","Line of Business":{"code":"LOB59","label":"Sustainability Software"}}]

Document Information

Modified date:
01 May 2020

UID

swg21687615

Page Feedback