IBM Support

Security Bulletin: A vulnerability in the GSKit component of Tivoli Network Manager IP Edition (CVE-2016-0201)

Created by Chandra Patel on

Security Bulletin


Summary

A vulnerability has been addressed in the GSKit component of Tivoli Network Manager IP Edition.

Vulnerability Details

CVEID: CVE-2016-0201
DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit this vulnerability to obtain authentication credentials.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/109310 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

  • IBM Tivoli Network Manager 3.8 is not affected by GSKit advisory.
  • IBM Tivoli Network Manager 3.9 bundles Informix Ultimate Edition 11.5 or 11.7, depending on fixpack level.
      • Please consult the security bulletin for Informix Dynamic Server for vulnerability details and information about fixes.
  • IBM HTTP Server shipped in IBM Tivoli Network Manager has been affected by this GSKit advisory.

    • Principal Product and Version(s)Affected Supporting Product and Version
    IBM Tivoli Network Manager 3.9Bundled the TIP version 2.1.0.x, which bundles IBM WebSphere version 7.0.0.x.
    IBM Tivoli Network Manager 4.1 and 4.1.1Bundled the TIP version 2.2.0.x, which bundles IBM WebSphere version 7.0.0.x.

    Remediation/Fixes


    Tivoli Network Manager IP Edition Interim Fixes for GSKit:
    Note:     The SSL connection between Tivoli Network Manager IP Edition and Tivoli Netcool/OMNIbus is affected.
    Single server SSL users, who have OMNIbus and the Network Manager core component on the same server, should upgrade to an appropriate OMNIbus fixpack to obtain the GSKit fix. Users with a remote OMNIbus SSL connection should upgrade to IBM GSKit 8.0.50.57 by applying the Interim Fix below on the Network Manager core server.


    AffectedProductVRMFAPARRemediation/First Fix
    Tivoli Network Manager IP Edition3.9.0.4IV81159IBM Tivoli Network Manager IP Edition 3.9 FP4 GSkit Interim Fix
    Tivoli Network Manager IP Edition 4.1IV81159IBM Tivoli Network Manager IP Edition 4.1.0 GSkit Interim Fix
    Tivoli Network Manager IP Edition4.1.1.1 IV81159IBM Tivoli Network Manager IP Edition 4.1.1 GSkit Interim Fix
    Tivoli Network Manager IP Edition4.2IV81159IBM Tivoli Network Manager IP Edition 4.2 GSkit Interim Fix

    Get Notified about Future Security Bulletins

    Subscribe to My Notifications to be notified of important product support alerts like this.

    References

    Complete CVSS v2 Guide
    On-line Calculator v2

    Off

    Related Information

    IBM Secure Engineering Web Portal
    IBM Product Security Incident Response Blog

    *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

    Disclaimer

    Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

    [{"Product":{"code":"SSSHRK","label":"Tivoli Network Manager IP Edition"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"--","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"3.9;4.1;4.1.1;4.2","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]

    Document Information

    Modified date:
    17 June 2018

    UID

    swg21975305

    Page Feedback