Security Bulletin: TLS padding vulnerability affects IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050, 5600, 5710, 7600, 7700 and 7710 (CVE-2014-8730)

Created by David Tam on Tue, 12/16/2014 - 10:31

Published URL:

https://www.ibm.com/support/pages/node/522317

522317

Security Bulletin

Summary

Transport Layer Security (TLS) padding vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) like attack affects IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050, 5600, 5710, 7600, 7700 and 7710.

Vulnerability Details

CVE-ID: CVE-2014-8730

DESCRIPTION:
Product could allow a remote attacker to obtain sensitive information, caused by the failure to check the contents of the padding bytes when using CBC cipher suites of some TLS implementations. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) like attack to decrypt sensitive information and calculate the plaintext of secure connections.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/99216 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Affected Products and Versions

IBM InfoSphere Balanced Warehouse C3000
IBM InfoSphere Balanced Warehouse C4000
IBM Smart Analytics System 1050
IBM Smart Analytics System 2050
IBM Smart Analytics System 5600
IBM Smart Analytics System 5710
IBM Smart Analytics System 7600
IBM Smart Analytics System 7700
IBM Smart Analytics System 7710

Remediation/Fixes

Find your IBM InfoSphere Balanced Warehouse or IBM Smart Analytics System product in the table below, apply the fix from Fix Central, and contact IBM Support with an APAR number to request a special build containing an interim fix.

For more information about IBM IDs, see the Help and FAQ.

Product	Affected Component	APAR	Download Link	Additional Information
IBM InfoSphere Balanced Warehouse C3000 IBM InfoSphere Balanced Warehouse C4000 IBM Smart Analytics System 1050 IBM Smart Analytics System 2050	IBM DB2 V9.7	IT06348	Contact IBM Support to obtain the fix.	Security Bulletin: TLS padding vulnerability affects IBM DB2 LUW (CVE-2014-8730)
IBM Smart Analytics System 5600 V1 IBM Smart Analytics System 5600 V2 IBM Smart Analytics System 5600 V3	IBM DB2 V9.7	IT06348	Contact IBM Support to obtain the fix.	Security Bulletin: TLS padding vulnerability affects IBM DB2 LUW (CVE-2014-8730)
	IBM DB2 V10.1	IT06350	Contact IBM Support to obtain the fix.
IBM Smart Analytics System 5710 IBM Smart Analytics System 7600	IBM DB2 V9.7	IT06348	Contact IBM Support to obtain the fix.	Security Bulletin: TLS padding vulnerability affects IBM DB2 LUW (CVE-2014-8730)
IBM Smart Analytics System 7700	IBM DB2 V9.7	IT06348	Contact IBM Support to obtain the fix.	Security Bulletin: TLS padding vulnerability affects IBM DB2 LUW (CVE-2014-8730)
	IBM DB2 V10.1	IT06350	Contact IBM Support to obtain the fix.
	IBM HTTP Server 7.0	PI31516	IBM Fix Central: Apply Fix Pack 37	Security Bulletin: TLS padding vulnerability affects IBM HTTP Server (CVE-2014-8730)
IBM Smart Analytics System 7710	IBM DB2 V9.7	IT06348	Contact IBM Support to obtain the fix.	Security Bulletin: TLS padding vulnerability affects IBM DB2 LUW (CVE-2014-8730)

For assistance, contact IBM Support:

In the United States and Canada dial 1-800-IBM-SERV
View the support contacts for other countries outside of the United States.
Electronically open a Service Request with IBM Support.

Workarounds and Mitigations

Find your IBM InfoSphere Balanced Warehouse or IBM Smart Analytics System product in the following table and follow the instructions provided in the Workaround and Mitigation column.

You should verify that applying this configuration change does not cause any compatibility issues.

Product	Affected Component	Workaround and Mitigation
IBM InfoSphere Balanced Warehouse C3000 IBM InfoSphere Balanced Warehouse C4000 IBM Smart Analytics System 1050 IBM Smart Analytics System 2050	IBM DB2 V9.7	Security Bulletin: TLS padding vulnerability affects IBM DB2 LUW (CVE-2014-8730)
IBM Smart Analytics System 5600 V1 IBM Smart Analytics System 5600 V2 IBM Smart Analytics System 5600 V3	IBM DB2 V9.7	Security Bulletin: TLS padding vulnerability affects IBM DB2 LUW (CVE-2014-8730)
	IBM DB2 V10.1
IBM Smart Analytics System 5710 IBM Smart Analytics System 7600	IBM DB2 V9.7	Security Bulletin: TLS padding vulnerability affects IBM DB2 LUW (CVE-2014-8730)
IBM Smart Analytics System 7700	IBM DB2 V9.7	Security Bulletin: TLS padding vulnerability affects IBM DB2 LUW (CVE-2014-8730)
	IBM DB2 V10.1
	IBM HTTP Server 7.0	Security Bulletin: TLS padding vulnerability affects IBM HTTP Server (CVE-2014-8730)
IBM Smart Analytics System 7710	IBM DB2 V9.7	Security Bulletin: TLS padding vulnerability affects IBM DB2 LUW (CVE-2014-8730)

For assistance, contact IBM Support:

In the United States and Canada dial 1-800-IBM-SERV
View the support contacts for other countries outside of the United States.
Electronically open a Service Request with IBM Support.

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Off

Change History

April 10, 2015: Added Remediation and Fixes.
December 19, 2014: Original version published.

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SSFVXC","label":"InfoSphere Balanced Warehouse"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Balanced Warehouse C Class - C3000","Platform":[{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"}],"Version":"9.7","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}},{"Product":{"code":"SSFVXC","label":"InfoSphere Balanced Warehouse"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Balanced Warehouse C Class - C4000","Platform":[{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"}],"Version":"9.7","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}},{"Product":{"code":"SSKT3D","label":"IBM Smart Analytics System"},"Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Component":"IBM Smart Analytics System 1050","Platform":[{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"}],"Version":"9.7","Edition":"","Line of Business":{"code":"","label":""}},{"Product":{"code":"SSKT3D","label":"IBM Smart Analytics System"},"Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Component":"IBM Smart Analytics System 2050","Platform":[{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"}],"Version":"9.7","Edition":"","Line of Business":{"code":"","label":""}},{"Product":{"code":"SSKT3D","label":"IBM Smart Analytics System"},"Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Component":"IBM Smart Analytics System 5600","Platform":[{"code":"PF016","label":"Linux"}],"Version":"9.7;10.1","Edition":"","Line of Business":{"code":"","label":""}},{"Product":{"code":"SSKT3D","label":"IBM Smart Analytics System"},"Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Component":"IBM Smart Analytics System 5710","Platform":[{"code":"PF016","label":"Linux"}],"Version":"9.7","Edition":"","Line of Business":{"code":"","label":""}},{"Product":{"code":"SSKT3D","label":"IBM Smart Analytics System"},"Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Component":"IBM Smart Analytics System 7600","Platform":[{"code":"","label":"AIX 6.1"}],"Version":"9.7","Edition":"","Line of Business":{"code":"","label":""}},{"Product":{"code":"SSKT3D","label":"IBM Smart Analytics System"},"Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Component":"IBM Smart Analytics System 7700","Platform":[{"code":"","label":"AIX 6.1"}],"Version":"9.7;10.1","Edition":"","Line of Business":{"code":"","label":""}},{"Product":{"code":"SSKT3D","label":"IBM Smart Analytics System"},"Business Unit":{"code":"BU050","label":"BU NOT IDENTIFIED"},"Component":"IBM Smart Analytics System 7710","Platform":[{"code":"","label":"AIX 6.1"}],"Version":"9.7","Edition":"","Line of Business":{"code":"","label":""}}]

Tips

Security Bulletin: TLS padding vulnerability affects IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050, 5600, 5710, 7600, 7700 and 7710 (CVE-2014-8730)

Security Bulletin

Summary

Vulnerability Details

Affected Products and Versions

Remediation/Fixes

Workarounds and Mitigations

Get Notified about Future Security Bulletins

References

Change History

Disclaimer

Was this topic helpful?

Document Information

UID

Share your feedback

Need support?

Tips

Security Bulletin: TLS padding vulnerability affects IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050, 5600, 5710, 7600, 7700 and 7710 (CVE-2014-8730)

Security Bulletin

Summary

Vulnerability Details

Affected Products and Versions

Remediation/Fixes

Workarounds and Mitigations

Get Notified about Future Security Bulletins

References

Related Information

Change History

Disclaimer

Was this topic helpful?

Document Information

UID

Share your feedback

Need support?