IBM Support

Security Bulletin: Vulnerability in SSLv3 affects Tivoli Netcool OMNIbus (CVE-2014-3566)

Security Bulletin


Summary

SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 may be enabled in the Tivoli Netcool OMNIbus server components, including the Object Server, Process Agent, and Gateways.

Vulnerability Details

CVE-ID: CVE-2014-3566

DESCRIPTION: Tivoli Netcool OMNIbus could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and access the plaintext of encrypted connections.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97013 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Affected Products and Versions

Tivoli Netcool/OMNIbus 7.3.0
Tivoli Netcool/OMNIbus 7.3.1
Tivoli Netcool/OMNIbus 7.4.0
Tivoli Netcool/OMNIbus 8.1.0

Remediation/Fixes

None

Workarounds and Mitigations

Two options (depending on versions):-

1) Configure the OMNIbus server components to use FIPS mode that will disable SSLv3 by default in favour of the more recent and secure protocols such as TLSv1.0/v1.1/v1.2. FIPS mode configuration is described here:
http://www-01.ibm.com/support/knowledgecenter/SSSHTQ_7.4.0/com.ibm.netcool_OMNIbus.doc_7.4.0/omnibus/wip/install/concept/omn_con_fips_configuringsupport.html?lang=en

IBM recommends that you review your entire environment to identify areas that enable the SSLv3 protocol and take appropriate mitigation and remediation actions. The most immediate mitigation action that can be taken is disabling SSLv3.

2) Or, with OMNIbus 7.4.0 FP 16 or OMNIbus 8.1.0 FP 15, it is possible to disable individual ciphers per protocol, and so all ciphers for the SSLv3 protocol can be disabled effectively disabling SSLv3 without having to enable FIPS mode. This work was completed under APAR IV97315. The documentation describing this can be found here:

https://www.ibm.com/support/knowledgecenter/en/SSSHTQ_8.1.0/com.ibm.netcool_OMNIbus.doc_8.1.0/omnibus/wip/admin/task/omn_adm_disableSSLTLScipers.html

Get Notified about Future Security Bulletins

References

Off

Acknowledgement

None

Change History

21 October 2014: Original Version Published
21 December 2016: Revised "disable SSL" to "disable SSLv3" and mentioned that FIPS mode(s) will use the more secure and more recent TLSv1.0/v1.1/v1.2 protocols.
03 November 2018: Revised Workarounds and Mitigations section to include IV97315 option to disable SSLv3 ciphers.

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

[{"Product":{"code":"SSSHTQ","label":"Tivoli Netcool\/OMNIbus"},"Business Unit":{"code":"BU004","label":"Hybrid Cloud"},"Component":"--","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"All Versions","Edition":""}]

Document Information

Modified date:
07 November 2018

UID

swg21687608