IBM Support

【セキュリティ情報】Communications Server GSKitの脆弱性の影響について (CVE-2016-0201)

Created by Makoto Tomota on
Published URL:
https://www.ibm.com/support/pages/node/539903
539903

Security Bulletin


Summary

Communications Server for Data Center Deployment, Communications Server for AIX, Communications Server for Linux, and Communications Server for Linux on System z, Communications Server for Windows　製品に含まれるGSKitに脆弱性があります。

Vulnerability Details

脆弱性の詳細：

CVEID: CVE-2016-0201
DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit this vulnerability to obtain authentication credentials.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/109310 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

影響のある製品・バージョン：

次の製品に影響があります。




プロダクトID 製品名
------------- ---------------------
5725H32 Communications Server for Data Center Deployment 7.0
5639F25 Communications Server for Windows V6.4 ,
5765E51 Communications Server for AIX V6.4
5724I33 Communications Server for Linux V6.4
5724I34 Communications Server for Linux on System z V6.4

Remediation/Fixes

修正策：

下記のGSKit のレベルでMD5衝突時の脆弱性に対応しています。

Communications Server for AIX V6.4, Communications Server for Windows V6.4, Communications Server for Linux V6.4, Communications Server for Linux on System z V6.4 and Communications Server for Data Center Deployment V7
のGSKit を下記のレベル以降を使用してください。

GSKit 8.0-50.57

Fix Central (製品グループ Other Softwareを選択)から　下記のAPAR番号の修正を含んだFIXもしくは、Fix Pack を導入してください。

製品バージョンAPAR修正(Fix)
Communications Server for Windows6.4.0.6JR55055OS-GSKIT8-57-UPDATE-6406-WINDOWS-UPDATE
( package package JR55055.zip)
Communications Server for AIX6.4.0.6IV80077OS-GSKIT8-57-UPDATE-6406-AIX-UPDATE
( package IV80077_gskit8_57_update.tar)
Communications Server for Linux 6.4.0.6LI78999OS-GSKIT8-57-UPDATE-6406-LINUX-UPDATE
(package LI78899_gskit8_57_update.tgz)
Communications Server for Data Center Deployment7.0.0.3LI78895 (Linux)
IV80074 (AIX)		OS-GSKIT8-57-UPDATE-7003-LINUX-UPDATE, OS-GSKIT8-57-UPDATE-7003-ZLINUX-UPDATE,
OS-GSKIT8-57-UPDATE-7003-AIX-UPDATE
( - package LI78895_gskit8_57_update.tgz for Linux (x86, ppc)
- package LI78895z_gskit8_57_update.tgz for Linux on System z
- package IV80074_gskit8_57_update.tar for AIX)
Communications Server for Linux on System z6.4.0.6LI78996OS-GSKIT8-57-UPDATE-6406-ZLINUX-UPDATE
(package LI78896_gskit8_57_update.tgz)

Workarounds and Mitigations

軽減策：

TLS 1.2 を使用する TN3270 を無効にする

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Complete CVSS v3 Guide
On-line Calculator v3

Off
.　　
[IBMサイト]
この文書は、米国 IBM 社の資料を翻訳した参考文書です。翻訳元の文書は、以下のリンクよりご参照ください。
Security Bulletin: A vulnerability in the GSKit component of Communications Server for Data Center Deployment, Communications Server for AIX, Communications Server for Linux, Communications Server for Linux on System z, Communications Server for Windows


[CVSS情報]
独立行政法人 情報処理推進機構: 共通脆弱性評価システムCVSS概説
JVN iPedia: CVSS計算ソフトウェア日本語版

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

.　
【お問合せ先】
技術的な内容に関して、サービス契約のあるお客様はIBMサービス・ラインにお問い合わせください。
IBM サービス・ライン
.

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Internal Use Only

Recommended fixes for Communications Server for AIX and Communications Server for Data Center Deployment on AIX

上記リンク切れのため、下記を追加。

Communications Server for Data Center Deployment, Version 7 -- Latest PTFs/Fixpack


2016/08/24 下記、リンクきれのため削除

Communications Server for AIX, Version 6.4 -- Latest PTFs
Communications Server for Linux, Version 6.4 -- Latest Fixpack

[{"Product":{"code":"SSKK8Z","label":"Communications Server for Data Center Deployment"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Component":"--","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"}],"Version":"7.0.0.0","Edition":"","Line of Business":{"code":"LOB35","label":"Mainframe SW"}},{"Product":{"code":"SSPQKF","label":"Communications Server for AIX"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Component":" ","Platform":[{"code":"PF002","label":"AIX"}],"Version":"6.3;6.3.1;6.4;7.0.0.0","Edition":"","Line of Business":{"code":"LOB35","label":"Mainframe SW"}},{"Product":{"code":"SSHQLW","label":"Communications Server for Linux"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Component":" ","Platform":[{"code":"PF016","label":"Linux"}],"Version":"6.2.3;6.4;7.0.0.0","Edition":"","Line of Business":{"code":"LOB35","label":"Mainframe SW"}},{"Product":{"code":"SSDMF3","label":"Communications Server for Linux on zSeries"},"Business Unit":{"code":"BU054","label":"Systems w\/TPS"},"Component":" ","Platform":[{"code":"PF016","label":"Linux"}],"Version":"6.2.3;6.4;7.0.0.0","Edition":"","Line of Business":{"code":"LOB35","label":"Mainframe SW"}},{"Product":{"code":"SSHQNF","label":"Communications Server for Windows"},"Business Unit":{"code":"BU054","label":"Systems w\/TPS"},"Component":" ","Platform":[{"code":"PF033","label":"Windows"}],"Version":"6.1.2;6.1.3;6.4","Edition":"","Line of Business":{"code":"LOB35","label":"Mainframe SW"}}]

Document Information

Modified date:
03 August 2018

UID

swg21975353

Page Feedback