IBM Support

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Worklight (CVE-2014-3509, CVE-2014-5139)

Created by Shyamala Rajagopalan on
Published URL:
https://www.ibm.com/support/pages/node/519535
519535

Security Bulletin


Summary

There are multiple vulnerabilities in OpenSSL that is used by the optional FIPS 140-2 data-in-motion feature in IBM Worklight. These issues were disclosed on August 6, 2014 by the OpenSSL Project.

Vulnerability Details

CVE-ID: CVE-2014-3509
DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a race condition in the ssl_parse_serverhello_tlsext() code. If a multithreaded client connects to a malicious server using a resumed session, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95159 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVE-ID: CVE-2014-5139
DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference when an SRP ciphersuite is specified without being properly negotiated with the client. A remote attacker could exploit this vulnerability to cause the client to crash.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95166 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Affected Products and Versions

  • IBM Worklight Consumer Edition Versions 6.1.0.0, 6.1.0.1 and 6.1.0.2
  • IBM Worklight Enterprise Edition Versions 6.1.0.0, 6.1.0.1 and 6.1.0.2

  • IBM Worklight Foundation Consumer Edition Version 6.2.0.0 and 6.2.0.1
  • IBM Worklight Foundation Enterprise Edition Version 6.2.0.0 and 6.2.0.1

Remediation/Fixes

Download the latest interim fix for your product and version:

V6.1.x: IBM Worklight Consumer Edition, IBM Worklight Enterprise Edition

V6.2.x: IBM Worklight Foundation Consumer Edition, IBM Worklight Foundation Enterprise Edition

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Off

OpenSSL Project vulnerability website

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

* 21 November 2014: Original cop published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SSZH4A","label":"IBM Worklight"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Security","Platform":[{"code":"PF014","label":"iOS"},{"code":"PF003","label":"Android"}],"Version":"6.2.0.1;6.2;6.1.0.2;6.1.0.1;6.1","Edition":"Consumer;Enterprise","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
17 June 2018

UID

swg21690507

Page Feedback