Security Bulletin: IBM Flex System Manager (FSM) and compatible IBM Systems Director agents are affected by vulnerabilities in OpenSSL (CVE-2013-4353, CVE-2013-6450, and CVE-2013-6449)

Created by Igets Administrator on Thu, 05/08/2014 - 13:24

Published URL:

https://www.ibm.com/support/pages/node/864528

864528

Security Bulletin

Summary

An interface on the IBM BladeCenter Advanced Management Module (AMM) may expose user account names and passwords that have been configured on that AMM.

Vulnerability Details

Abstract

The FSM and compatible agents contain a version of openssl that contained the 3 vulnerabilities listed above.

Content

Vulnerability Details:

CVE ID	Description	Fix Target Date	Fix Version
CVE-2013-4353 CVSS Base Score: 5 CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/90201 CVSS Environmental Score: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)	Invalid TLS handshake causes null pointer exception.	05/09/14	V 1.2.0.1 V 1.2.1.1 V 1.3.0.2 V 1.3.1.1
CVE-2013-6450 CVSS Base Score: 4.3 CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/90069 CVSS Environmental Score: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)	Remote attacker could cause openssl to crash due to improperly maintained data structures.	05/09/14	V 1.2.0.1 V 1.2.1.1 V 1.3.0.2 V 1.3.1.1
CVE-2013-6449 CVSS Base Score: 4.3 CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/90068 CVSS Environmental Score: Undefined CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)	Attacker can crash openssl with a TLS1.2 exploit.	05/09/14	V 1.2.0.1 V 1.2.1.1 V 1.3.0.2 V 1.3.1.1

Affected products and versions

From the FSM command line enter lsconfig –V to determine the level of FSM installed.

FSM

Flex System Manager 1.2.0
Flex System Manager 1.2.1
Flex System Manager 1.3.0
Flex System Manager 1.3.0.1
Flex System Manager 1.3.1

Agents

Agents for FSM 1.2.0 or 1.2.1
- IBM Systems Director Platform Agent for Windows 6.3.2
- IBM Systems Director Common Agent for Windows 6.3.2
- IBM Systems Director Platform Agent for Linux 6.3.2
- IBM Systems Director Common Agent for Linux 6.3.2
Agents for FSM 1.3.0, 1.3.0.1,
- IBM Systems Director Platform Agent for Windows 6.3.4
- IBM Systems Director Common Agent for Windows 6.3.4
- IBM Systems Director Platform Agent for Linux 6.3.4
- IBM Systems Director Common Agent for Linux 6.3.4
Agents for FSM 1.3.1
- IBM Flex System Platform Agent for Windows 1.3.1
- IBM Flex System Common Agent for Windows 1.3.1
- IBM Flex System Platform Agent for Linux 1.3.1
- IBM Flex System Common Agent for Linux 1.3.1

NON-AFFECTED PRODUCTS and VERSIONS

The following FSM levels are not vulnerable to these CVEs.

Flex System Manager 1.1.0
Flex System Manager 1.1.0.1
Flex System Manager 1.1.1
Flex System Manager 1.2.0.1
Flex System Manager 1.2.1.1
Flex System Manager 1.3.0.2
Flex System Manager 1.3.1.1

Agent vulnerability is dependent on which platform the agent is installed. Details for each agent are included in the Remediation section below.

Remediation:

The remediation for these vulnerabilities is a subset of the action required for CVE-2014-0160 (also referred to as Heartbleed).

IBM recommends that you complete the remediation for CVE-2014-0160. When you have completed the CVE-2014-0160 remediation you will no longer be vulnerable to the exposures listed in this Security Bulletin.

The Security Bulletin for IBM Flex System Manager and the associated agents for CVE-2014-0160 is here.

If you have already completed the remediation for CVE-2014-0160, then no further action is required.

Workaround(s) & Mitigation(s):

None Known

References:

Related Information:
IBM Secure Engineering Web Portal

Acknowledgement
None

Change History
7 May 2014: Original Copy Published

* The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Flash.

Note: According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v3 Guide
On-line Calculator v3

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Document Location

Worldwide

Operating System

PureFlex System and Flex System:Operating system independent / None

[{"Type":"HW","Business Unit":{"code":"BU054","label":"Systems w\/TPS"},"Product":{"code":"HW94A","label":"Flex System Manager Node"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"LOB57","label":"Power"}}]

Tips