Security Bulletin
Summary
SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 is enabled in Communications Server for Windows.
Vulnerability Details
CVE-ID: CVE-2014-3566
DESCRIPTION: Product could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and access the plain text of encrypted connections.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97013 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Affected Products and Versions
Communications Server for Windows, V6.4
Communications Server for Windows, V6.1
Remediation/Fixes
IBM recommends that you review your entire environment to identify areas that enable the SSLv3 protocol and take appropriate mitigation and remediation actions. The most immediate mitigation action that can be taken is disabling SSLv3.
NOTE: This will disable SSLv3 on the server, requiring all clients to use TLS 1.0 instead. If the client does not support TLS, then the connection will fail. You will have to determine if this is a viable option for your environment.
Communications Server for Windows, V6.4.0.6
Apply APAR JR51581: Disable SSLv3 for CVE-2014-3566.
To obtain the V6.4.0.6 fixpack and the JR51581 fix, see Communications Server for Windows, Version 6.4 -- Latest Fixpack.
Communications Server for Windows, V6.1.3.4
Apply APAR JR51690: Disable SSLv3 for CVE-2014-3566.
To obtain the V6.3.1.4 fixpack and the JR51690 fix, see Communications Server for Windows, Version 6.1.3 -- Latest Fix Pack.
If you apply the APAR fix (JR51581/JR51690) and later determine that you need SSLv3, restore the original modules that were replaced by the APAR fix package, stop and restart Communications Server.
In future fixpacks, we plan to provide two versions of the affected modules, one with SSLv3 disabled and one with SSLv3 enabled, with the SSLv3-disabled version installed by default. The accompanying readme.html file will provide instructions for replacing the modules to enable SSLv3 if it is needed.
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Change History
10 November 2014 Original Version Published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Product Synonym
cswin comm server commserver csnt sna
Was this topic helpful?
Document Information
Modified date:
02 August 2018
UID
swg21689735