SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 may be enabled in the Tivoli Netcool OMNIbus server components, including the Object Server, Process Agent, and Gateways.
DESCRIPTION: Tivoli Netcool OMNIbus could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and access the plaintext of encrypted connections.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97013 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Affected Products and Versions
Tivoli Netcool/OMNIbus 7.3.0
Tivoli Netcool/OMNIbus 7.3.1
Tivoli Netcool/OMNIbus 7.4.0
Tivoli Netcool/OMNIbus 8.1.0
Workarounds and Mitigations
Two options (depending on versions):-
1) Configure the OMNIbus server components to use FIPS mode that will disable SSLv3 by default in favour of the more recent and secure protocols such as TLSv1.0/v1.1/v1.2. FIPS mode configuration is described here:
IBM recommends that you review your entire environment to identify areas that enable the SSLv3 protocol and take appropriate mitigation and remediation actions. The most immediate mitigation action that can be taken is disabling SSLv3.
2) Or, with OMNIbus 7.4.0 FP 16 or OMNIbus 8.1.0 FP 15, it is possible to disable individual ciphers per protocol, and so all ciphers for the SSLv3 protocol can be disabled effectively disabling SSLv3 without having to enable FIPS mode. This work was completed under APAR IV97315. The documentation describing this can be found here:
Get Notified about Future Security Bulletins
21 October 2014: Original Version Published
21 December 2016: Revised "disable SSL" to "disable SSLv3" and mentioned that FIPS mode(s) will use the more secure and more recent TLSv1.0/v1.1/v1.2 protocols.
03 November 2018: Revised Workarounds and Mitigations section to include IV97315 option to disable SSLv3 ciphers.
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
07 November 2018