Security Bulletin
Summary
SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 is enabled in IBM InfoSphere Optim Performance Manager (OPM).
Vulnerability Details
CVE-ID: CVE-2014-3566
DESCRIPTION: IBM InfoSphere Optim Performance Manager could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and access the plaintext of encrypted connections.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97013 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Affected Products and Versions
IBM Optim Performance Manager for DB2 on Linux, UNIX, and Windows version 4.1 through 4.1.1
IBM InfoSphere Optim Performance Manager for DB2 on Linux, UNIX, and Windows version 5.1 through 5.3.1
Remediation/Fixes
|
OPM Version | Download URL |
| 4.1 – 5.1.1.1 | Replace JRE (V6 SR16 Fix Pack 2) |
| 5.2 | Fix Central (Interim Fix 6269) |
| 5.3 | Fix Central (Interim Fix 7386) |
| 5.3.1 | Fix Central (Interim Fix 8377) |
For OPM versions 4.1 through 5.1.1.1, you must replace the IBM Runtime Environment, Java™ Technology Edition (JRE) that is installed with OPM, with the latest IBM Runtime Environment, Java™ Technology Edition (Version 6 Service Refresh 16 Fix Pack 2 and subsequent releases). Detailed instructions are available here: “Updating the IBM Runtime Environment, Java™ Technology Edition for InfoSphere Optim Performance Manager”.
For OPM versions 5.2 through 5.3.1, installing the Interim Fix changes the web console server configuration so that it disables the SSLv3 protocol and permits only TLS 1.0 or higher for HTTPS connections.
After installing the Interim Fix, if you need to re-enable the SSLv3 protocol, edit the server.xml file that is located in the InfoSphere Optim Performance Manager installation directory:
- wlp/usr/servers/dsweb/server.xml
Remove the following line and then save the file:
- <include optional="true" location="./TLSOnlyConfig.xml"/>
A restart is not required for this change to take effect.
IBM recommends that you review your entire environment to identify areas that enable the SSLv3 protocol and take appropriate mitigation and remediation actions. The most immediate mitigation action that can be taken is disabling SSLv3.
Workarounds and Mitigations
IBM InfoSphere Optim Performance Manager (OPM) relies on IBM WebSphere Application Server (WAS) to manage the SSL protocol used for secure network connections. Older OPM versions (4.1 through 5.1.1.1) use WAS Smash, newer OPM versions (since 5.2) use WAS Liberty Profile.
For more details, see the Workarounds and Mitigations section in this document Security Bulletin: Vulnerability in SSLv3 affects IBM WebSphere Application Server (CVE-2014-3566).
The following steps outline how to apply these mitigations to OPM 5.2 through 5.3.1.
Edit the SSLConfig.xml file to specify the default SSL configuration to be used by IBM InfoSphere Optim Performance Manager. The SSLConfig.xml file is located in the InfoSphere Optim Performance Manager installation directory:
wlp/usr/servers/dsweb/SSLConfig.xml
<server>
<keyStore id="defaultKeyStore" password="password"/>
</server>
A 'ssl' element can be added to specify the minimal level of security for the SSL protocol. Setting the 'sslProtocol' attribute to ”TLS” ensures that SSLv3 will no longer be used.
After making these changes, the contents of the SSLConfig.xml file may look like this:
<server>
<ssl id="defaultSSLConfig"
keyStoreRef="defaultKeyStore"
sslProtocol="TLS" />
<keyStore id="defaultKeyStore" password="password"/>
</server>
If an 'ssl' element already exists, ensure that it includes the attribute sslProtocol="TLS". There is no need to modify the 'keyStore' entry, if you have customized it, for example to point to your own key store location, you can retain the entry as is. It is not required to restart the web console server after this update.
Get Notified about Future Security Bulletins
References
Security Bulletin IBM WebSphere Application Server (CVE-2014-3566)
Acknowledgement
None
Change History
2014-10-22 Original version published
2014-10-27 Update OPM versions that use WAS Liberty Profile
2014-11-14 Update Remediation/Fixes section
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Internal Use Only
Internal Update History:
2015-02-16: ckadner - update version list to include 4.1.0.1 and 4.1.1
Was this topic helpful?
Document Information
Modified date:
08 July 2021
UID
swg21687948