IBM Support

Security Bulletin: Vulnerability with RSA Export Keys may affect IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2015-0138)

Created by Philip J Ross on
Published URL:
https://www.ibm.com/support/pages/node/259743
259743

Security Bulletin


Summary

The "FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability affects IBM Sterling B2B Integrator and IBM Sterling File Gateway.

Vulnerability Details

CVE ID: CVE-2015-0138

DESCRIPTION: A vulnerability in various IBM SSL/TLS implementations could allow a remote attacker to downgrade the security of certain SSL/TLS connections. An IBM SSL/TLS client implementation could accept the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. This could allow a remote attacker using man-in-the-middle techniques to facilitate brute-force decryption of TLS/SSL traffic between vulnerable clients and servers.

This vulnerability is also known as the FREAK attack.


CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/#/vulnerabilities/100691 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Affected Products and Versions

IBM Sterling B2B Integrator 5.2

IBM Sterling File Gateway 2.2

Sterling Integrator 5.1

Sterling File Gateway 2.1

Remediation/Fixes

Product & Version

Remediated Fix
Sterling Integrator 5.1 or

Sterling File Gateway 2.1
  1. Upgrade Sterling Integrator to 5.1.0.4 and apply Generic Interim Fix 5104_6.

  2. For Linux, AIX and Windows, go to the Fix Central for IBM Java fixes to download IBM® SDK Java™ Technology Edition, Version 6 Service Refresh 16 Fix Pack 3 and subsequent releases.


    For Solaris and HP-UX, refer to the Java vendor to find the appropriate version that addresses the “FREAK” vulnerability.
IBM Sterling B2B Integrator 5.2 or

IBM Sterling File Gateway 2.2
  1. Upgrade Sterling B2B Integrator to 5.2.5.0.

  2. For Linux, AIX and Windows, go to the Fix Central for IBM Java fixes to download IBM® SDK Java™ Technology Edition, Version 7 Service Refresh 8 Fix Pack 10 and subsequent releases.

    For Solaris and HP-UX, go to Fix Central to download the fix for:
    • HP® SDK™ for J2SE™ HP-UX® 11i platform adapted by IBM® for IBM® Software Version 7 Service Refresh 8 Fix Pack 10 and subsequent releases.
    • IBM 64-bit SDK for Solaris™ Java™ Technology Edition Version 7 Service Refresh 8 Fix Pack 10 and subsequent releases.

  3. Make configuration changes specified in Workarounds and Mitigations section below
You should verify applying this fix does not cause any compatibility issues.

Workarounds and Mitigations

The following table provides instructions on how to make configuration changes to both Sterling B2B Integrator 5.2 and 5.1. After making the necessary changes, you will need to stop and restart IBM Sterling B2B Integrator in order for these changes to take affect.

If you use:Then do this:
Sterling B2B Integrator 5.1 or 5.2 or
Sterling File Gateway 2.1 or 2.2		Put following entries in customer_overrides.properties

security.WeakCipherSuite=TLS_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_RC4_128_MD5

security.StrongCipherSuite=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_DES_CBC_SHA

security.AllCipherSuite=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_DES_CBC_SHA,TLS_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_RC4_128_MD5

IBM recommends the use of strong ciphers in the configuration for adapters.

Product UIs (including Dashboard) for Sterling Integrator 5.1 or
Sterling File Gateway 2.1
  1. Upgrade Sterling Integrator to 5104_6 if Sterling Integrator version is lower than 5104_6

  2. Put following entry in customer_overrides.properties

    security.dashboardCipherSuite=strong
WSMQ adapters and services

MQFTE adapters and services

CD:Server adapters and services

MEIG Message Configuration Adapter

IBM recommends the use of strong ciphers in the configuration for adapters and services and to not use the cipher with RSA_EXPORT.
You should verify applying this configuration change does not cause any compatibility issues.

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Acknowledgement

The vulnerability was reported to IBM by Karthikeyan Bhargavan of the PROSECCO team at INRIA

Change History

03 April 2015: Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SS3JSW","label":"IBM Sterling B2B Integrator"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"--","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"5.2;5.1","Edition":"","Line of Business":{"code":"LOB59","label":"Sustainability Software"}}]

Document Information

Modified date:
16 June 2018

UID

swg21700868

Page Feedback