-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2014.0224
Security Bulletin: IBM Security Network Intrusion Prevention System can be
                  affected by vulnerabilities in OpenSSL
                             21 February 2014

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IBM Security Network Intrusion Prevention System
Publisher:         IBM
Operating System:  Network Appliance
Impact/Access:     Denial of Service -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2013-6450 CVE-2013-6449 CVE-2013-4353

Reference:         ASB-2014.0014
                   ESB-2014.0082
                   ESB-2014.0056
                   ESB-2014.0025
                   ESB-2014.0021
                   ESB-2014.0007

Original Bulletin: 
   http://www-01.ibm.com/support/docview.wss?uid=swg21664833

- --------------------------BEGIN INCLUDED TEXT--------------------

Security Bulletin: IBM Security Network Intrusion Prevention System can be 
affected by vulnerabilities in OpenSSL (CVE-2013-4353, CVE-2013-6450, and 
CVE-2013-6449)

Flash (Alert)

Document information

More support for:

IBM Security Network Intrusion Prevention System

Software version:

4.6.1

Operating system(s):

Firmware

Reference #:

1664833

Modified date:

2014-02-14

Abstract

The IBM Security Network Intrusion Prevention System can be affected by three
vulnerabilities in OpenSSL. These vulnerabilities include crafting invalid TLS
handshake to crash OpenSSL, using a flaw in Datagram TLS(DTLS) handling to 
crash an application and using a flaw to crash an application with TLS 1.2.

Content

VULNERABILITY DETAILS

The following information was provided by OpenSSL. In the case of IBM Security
Network Intrusion Prevention System, the Local Management Interface, SSH and 
the security management network ports are affected by the vulnerabilities

CVE-ID:

CVE-2013-4353

DESCRIPTION:

A carefully crafted invalid TLS handshake could crash OpenSSL with a NULL 
pointer exception. A malicious server could use this flaw to crash a 
connecting client. This issue only affected OpenSSL 1.0.1 versions.

The attack does not require authentication, local network access or 
specialized knowledge. An exploit could impact the availability of the system
but the integrity of data and the confidentiality of information would not be
compromised.

CVSS:

CVSS Base Score: 5.0

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/90201 for the 
current score

CVSS Environmental Score*: Undefined

CVSS Vector (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVE-ID:

CVE-2013-6450

DESCRIPTION:

A flaw in DTLS handling can cause an application using OpenSSL and DTLS to 
crash. OpenSSL versions prior to 1.0.0 are not vulnerable. OpenSSL is 
vulnerable to a denial of service, caused by the failure to properly maintain
data structures for digest and encryption contexts by the DTLS retransmission
implementation. A remote attacker could exploit this vulnerability to cause 
the daemon to crash.

The attack does not require authentication or local network access but some 
degree of specialized knowledge and techniques are required. An exploit would
not impact the confidentiality of information or the integrity of data, but 
the availability of the system could be compromised.

CVSS:

CVSS Base Score: 4.3

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/90069 for the 
current score

CVSS Environmental Score*: Undefined

CVSS Vector (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVE ID:

CVE-2013-6449

DESCRIPTION:

A flaw in OpenSSL can cause an application using OpenSSL to crash when using 
TLS version 1.2. This issue only affected OpenSSL 1.0.1 versions. OpenSSL is 
vulnerable to a denial of service, caused by an error in the 
ssl_get_algorithm2 function. A remote attacker could exploit this 
vulnerability using specially-crafted traffic from a TLS 1.2 client to cause 
the daemon to crash.

The attack does not require authentication or local network access but some 
degree of specialized knowledge and techniques are required. An exploit would
not impact the confidentiality of information or the integrity of data, but 
the availability of the system could be compromised.

CVSS Base Score: 4.3

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/90068 for the 
current score

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

AFFECTED PRODUCTS AND VERSIONS:

Products: GX3002, GX4002, GX4004, GX4004-v2, GX5008, GX5008-v2, GX5108, 
GX5108-v2, GX5208, GX5208-v2, GX6116, GX7412, GX7412-10, GX7412-05, GX7800, 
GV200, GV1000

Firmware versions: 4.6.1

REMEDIATION:

The following IBM Threat Fixpack have the fixes for these vulnerabilities:

Proventia Network Intrusion Prevention System 4.6.1 All Models System-HotFix-1

for all IBM Security Network Intrusion Prevention System products at Firmware
version 4.6.1

Workaround(s):

None

Mitigation(s):

None

REFERENCES:

Complete CVSS Guide

On-line Calculator V2

CVE-2013-4353

CVE-2013-6450

CVE-2013-6449

http://xforce.iss.net/xforce/xfdb/90201

http://xforce.iss.net/xforce/xfdb/90069

http://xforce.iss.net/xforce/xfdb/90068

RELATED INFORMATION:

IBM Secure Engineering Web Portal

IBM Product Security Incident Response Blog

ACKNOWLEDGEMENT

None

CHANGE HISTORY

14 February 2014 - initial publication

*The CVSS Environment Score is customer environment specific and will 
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the 
Reference section of this Flash.

Note: According to the Forum of Incident Response and Security Teams (FIRST),
the Common Vulnerability Scoring System (CVSS) is an "industry open standard 
designed to convey vulnerability severity and help to determine urgency and 
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY 
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT 
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBUwatpBLndAQH1ShLAQI8fhAAgjecHxYW1ccURN3lDmrObKq9AU2xrPzN
mKm7VZ+UhUzphaIRtVN5gauxxQbZVtQWGPsqwMq7MWlB4Z5m8XMQ0rZJQlY900UE
jIlIk8Pfkqq+lpZlSL5psunC5Qp239I0ybI+YN/KbQjMvqVkhZkZHkxIU/IO2Rjw
LMaGqflE2TbhXyx+tdSa8hJV1BN/8kvqSHm+H9GTf55pT0qYHyi7GyO2sQ42112I
SSvnJWhHsCEs1HaAuVU6rrz4OkAo/sE1PjDDN6DaRDKR/TYFKc6v6k97WC/ExKvb
170wUhX246q6yVy08qwyaOI2/ZD0vMyf+Cpje2sLqfvSUzNZPs5Xg1nCeO0VS4K/
KMYMWNblceYs4wLHmNxosLhw76oEmF2Oth4SXjCjnhj7/YAnNL4y+dUVdftg1W7x
vSD7e/V+/CzXss6Qz7hsIl97R7u7k4IahKgfYPBQBeohONJemW3pCmas9Nv8kzeE
+vCz6zA9vY73vdArCuUdck/C+29kLf2PVo15Dvw6pFe6s0yzR6nlqfjXBNpMsEXy
Z6o5tSRL10d/F3Quc9iOthkpDNVQEHGGTPYTeykaaxydN+kEyAslPbR4ORvu4WQY
V8FWxtRsVbSNTSrPVyyh6I0luHEXdCBalTQWaXBG9TOuzcgG5XLclA5hl+1QqyQ+
+WnZXAkLum0=
=l+R0
-----END PGP SIGNATURE-----