Security Bulletin
Summary
IBM Informix Dynamic Server can be affected by a TLS (Transport Layer Security) padding vulnerability which can allow a remote attacker to obtain sensitive information.
Vulnerability Details
The following vulnerability affects IBM Informix Dynamic Server.
CVEID: CVE-2014-8730
DESCRIPTION: IBM Informix Dynamic Server could allow a remote attacker to obtain sensitive information, caused by the failure to check the contents of the padding bytes when using CBC cipher suites of some TLS implementations. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) like attack to decrypt sensitive information and calculate the plaintext of secure connections.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/99216 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Affected Products and Versions
IBM Informix Dynamic Server 11.50, 11.70, and 12.10
Remediation/Fixes
Use the workaround/mitigation until you can update to the latest GSKit.
Upgrading GSKit:
Download the appropriate GSKit version: 8.0.50.41
Or
or use the GSKit bundled with : Informix Client SDK 4.10.xC5
| Product | Remediation/First Fix |
| Informix Server 12.10 | Upgrade to 12.10.xC5 or download and install GSKit (see next section) |
| Informix Server 11.70 | Download and install the updated GSKit (see next section) |
| Informix Server 11.50 | See Workarounds and Mitigations section, below. |
Upgrading GSKit:
- Download the appropriate GSKit using the following table:
- Unix/Linux instructions:
| Required GSKit version | GSKit link |
| 8.0.50.41 | AIX (pSeries_32, pSeries_64) HP-UX (Itanium_32, Itaniuam 64) Linux (x86_32, x86_64, pSeries_64, zSeries_32, zSeries_64) Solaris (SPARC_32, SPARC_64, x86_32, x86_64) Windows (x86_32, x86_64) |
- 1. Copy the downloaded tar file(s) to $INFORMIXDIR/gskit. Note: the old gskit .tar files must be removed or renamed to not end in .tar.
2. Bring the database server offline. (e.g. onmode -ky).
3. Change to the GSKit directory (cd $INFORMIXDIR/gskit).
4. As root, run "./installgskit".
5. To verify the installation, run the appropriate command (i.e. gsk8ver or gsk8ver_64) for the GSKit you installed. The new version should be 8.0.50.41.
- 1. Copy/download the gsk*_win32.exe file to C:\tmp.
2. Start the 'cmd' program.
3. Change to the C:\tmp directory (cd c:\tmp).
4. Run "gsk8d_8.0.50.41_win32.exe /D tmp". This will extract the files to the C:\tmp\tmp directory.
5. Change to the C:\tmp\tmp directory (cd C:\tmp\tmp).
6. Run "setup GSK8BAS". Accept all of the defaults.
7. Run gsk8ver to verify the installation. The new version should be 8.0.50.41
4. All other Windows versions instructions:
- 1. Copy/download the appropriate file (gsk8d_8.0.50.4_win64.msi, gsk8ssl32.exe or gsk8ssl64.exe) to C:\tmp.
2. Using Windows Explorer, double click on the downloaded file. This will start InstallShield. Accept all of the defaults.
3. To verify the installation, run the appropriate command (i.e. gsk8ver_64, or gsk8ver) for the GSKit you installed. The new version should be 8.0.50.41.
Workarounds and Mitigations
Until the GSKit update is in place, in the IBM Informix Dynamic Server environment, set GSK_STRICTCHECK_CBCPADBYTES=GSK_TRUE
Restart the oninit process in order for the environment setting to take affect.
Note: Applying this fix does not cause any compatibility issues
Get Notified about Future Security Bulletins
Important Note
IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.
References
Acknowledgement
None
Change History
19 December 2014
05 May 2015
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
03 June 2021
UID
swg21693052