IBM Support

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects the IBM Tivoli Storage Manager Client and the IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware data mover (CVE-2015-4000)

Created by Robyn Stillwell on
Published URL:
https://www.ibm.com/support/pages/node/273789
273789

Security Bulletin


Summary

The Logjam Attack on TLS connections using the Diffie-Hellman (DH) key exchange protocol affects the IBM Tivoli Storage Manager Client. However, the problem only manifests when the Tivoli Storage Manager Client is used as the IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware data mover.

Vulnerability Details

CVEID: CVE-2015-4000
DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey a DHE_EXPORT ciphersuite choice. An attacker could exploit this vulnerability using man-in-the-middle techniques to force a downgrade to 512-bit export-grade cipher. Successful exploitation could allow an attacker to recover the session key as well as modify the contents of the traffic. This vulnerability is commonly referred to as "Logjam".
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/103294 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Affected Products and Versions

This security exposure affects network connections between the Tivoli Storage Manager Client (IBM Spectrum Protect Client) and VMware services. However, the problem only manifests when the Tivoli Storage Manager Client is used in conjunction with Tivoli Storage Manager for Virtual Environments (IBM Spectrum Protect for Virtual Environments): Data Protection for VMware. Therefore, this exposure affects:

  • Tivoli Storage Manager Client levels 7.1.2.0 through 7.1.3.1 for the Windows and Linux x86 platforms.
  • Tivoli Storage Manager for Virtual Environments: Data Protection for VMware versions 7.1.2 and 7.1.3.

      • Note: The Tivoli Storage Manager Client for Windows and Linux x86 is shipped within and used as the Data Protection for VMware data mover.

Remediation/Fixes

Tivoli Storage Manager Client Release

Fixing VRM Level

Platform		Link to Fix / Fix Availability Target
7.17.1.4Linux x86
Windows		http://www.ibm.com/support/docview.wss?uid=swg24041094
This issue has also been fixed in Tivoli Storage Manager Client level 7.1.3.2. You can download and apply the 7.1.3.2 fix using this link: http://www.ibm.com/support/docview.wss?uid=swg24041143


Tivoli Storage Manager for Virtual Environments: Data Protection for VMware ReleaseFixing VRM LevelPlatformLink to Fix / Fix Availability Target
7.17.1.4Linux
Windows		http://www.ibm.com/support/docview.wss?uid=swg24041094

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

04 December 2015 - Initially published
16 December 2015 - Updated to include TSM client fixing level and fix

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SSGSG7","label":"Tivoli Storage Manager"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Component":"Client","Platform":[{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"}],"Version":"7.1","Edition":"All Editions","Line of Business":{"code":"LOB26","label":"Storage"}},{"Product":{"code":"SS8TDQ","label":"Tivoli Storage Manager for Virtual Environments"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Component":"Data Protection for VMware","Platform":[{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"}],"Version":"7.1","Edition":"All Editions","Line of Business":{"code":"LOB26","label":"Storage"}}]

Document Information

Modified date:
17 June 2018

UID

swg21972372

Page Feedback