Security Bulletin: Vulnerability in RC4 stream cipher affects IBM PureData System for Analytics (CVE-2015-2808)

Workarounds and Mitigations

Remove RC4 as an authentication option for the Integrated Management Modules (IMM) on IBM PureData System for Analytics appliances. Follow these steps to update the IMMs on your appliance, or contact IBM Support if you need assistance.

1. Open a web browser such as Internet Explorer or Mozilla Firefox (preferred).
2. In the URL address, specify the IMM hostname or IMM IP address:
   
   http://<management_module_hostname>
   
   or
   
   http://<IP_address_for_mm>
   
   NOTE: You must have the hostname/IP address for each IMM in the system, and the
   user/password to access the IMM.
   
   
3. For an IMM version 1 model, perform the following steps:
   
   a. In the Integrated Management Module window, in the left panel, navigate to the Security tab.
   b. Scroll down to the option for Cryptography Management.
   c. Select the radio button for High Security Mode. Click Save.
   d. On the main IMM page, select the Restart IMM tab.
   e. Restart the IMM.
   
   
4. For an IMM II (version 2) model, perform the following steps:
   
   a. In the Integrated Management Module II window, select the IMM Management tab.
   b. Select Security.
   c. Select the Cryptography Management tab.
   d. Select the radio button for NIST SP 800-131A Compliance Mode.
   e. On the IMM Management tab, select Restart IMM.
   f. Restart the IMM.

1. Log in as root to a client system in your network.
2. Type the following command to connect to the IP address of the IMM:
   
   [root@local_rh5 store]# openssl s_client -cipher RC4-SHA -connect <IP ADDRESS>:443
   
   
3. If the IMM is vulnerable and allows RC4 connections, the command succeeds with the following message:
   
   CONNECTED(00000003)
   
   
4. If the IMM is configured to block RC4 connections, the command fails with the following message:
   
   socket: Connection refused
   connect:errno=29

For an IMM II (version 2) model:

1. Log in as root to a client system in your network.
2. Type the following command to connect to the IP address of the IMM II:
   
   [root@local_rh5 store]# openssl s_client -cipher RC4-SHA -connect <IP ADDRESS>:443
   
   
3. If the IMM II is vulnerable and allows RC4 connections, the command succeeds with the following message:
   
   CONNECTED(00000003)
   depth=0 /C=US/ST=NC/L=RTP/O=System X/CN=IMM2-40f2e9dcc9e6
   
   verify error:num=18:self signed certificate
   verify return:1
   
   
4. If the IMM II is configured to block RC4 connections, the command fails with either the "connection refused" message or a handshake failure, for example:
   
   CONNECTED(00000003)
   2692:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188:

You should verify applying this configuration change does not cause any compatibility issues. Not disabling the RC4 stream cipher will expose yourself to the attack described above. IBM recommends that you review your entire environment to identify other areas where you have enabled the RC4 stream cipher and take appropriate mitigation and remediation actions.