-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2014.0385
   Security Bulletin: IBM Security Directory Server can be affected by a
     vulnerability in IBM WebSphere Application Server (CVE-2014-0411)
                               24 March 2014

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IBM Security Directory Server
Publisher:         IBM
Operating System:  Windows
                   AIX
                   Red Hat
                   SUSE
                   Solaris
Impact/Access:     Modify Arbitrary Files   -- Remote/Unauthenticated
                   Delete Arbitrary Files   -- Remote/Unauthenticated
                   Access Confidential Data -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2014-0411  

Reference:         ASB-2014.0005
                   ESB-2014.0383
                   ESB-2014.0376
                   ESB-2014.0368
                   ESB-2014.0350
                   ESB-2014.0335
                   ESB-2014.0305
                   ESB-2014.0294
                   ESB-2014.0289
                   ESB-2014.0271
                   ESB-2014.0251
                   ESB-2014.0210
                   ESB-2014.0156
                   ESB-2014.0136
                   ESB-2014.0128
                   ESB-2014.0114
                   ESB-2014.0102
                   ESB-2014.0065
                   ESB-2014.0058

Original Bulletin: 
   http://www-01.ibm.com/support/docview.wss?uid=swg21667352

- --------------------------BEGIN INCLUDED TEXT--------------------

Security Bulletin: IBM Security Directory Server can be affected by a 
vulnerability in IBM WebSphere Application Server (CVE-2014-0411)

Security Bulletin

Document information

More support for:

IBM Security Directory Server

Software version:

6.1, 6.2, 6.3, 6.3.1

Operating system(s):

All Platforms

Reference #:

1667352

Modified date:

2014-03-17

Summary

The IBM WebSphere Application Server component provided with IBM Security 
Directory Server is vulnerable to a transport layer security (TLS) timing 
attack.

Vulnerability Details

CVEID:

CVE-2014-0411

DESCRIPTION:

The IBM Security Directory Server (ISDS) uses Websphere Application Server 
(WAS) to provide access to web applications for ISDS.

The implementation of TLS used by ISDS is subject to a timing attack that 
could be exploited by a man in the middle attack to decrypt the encrypted 
communication.

The attack does not require local network access or authentication, but a high
degree of specialized knowledge and techniques are required. An exploit would
not affect the availability of the system, but it could impact the 
confidentiality of information and the integrity of data.

CVSS Base Score: 4

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/90357 for the 
current score

CVSS Environmental Score*: Undefined

CVSS Vector: (AV/N:AC/H:Au/N:C/P:I/P:A/N)

Affected Products and Versions

ISDS 6.1, 6.2, 6.3, and 6.3.1

Remediation/Fixes

Determine the WAS and IBM SDK for Java version of the ISDS Web 
Application, which is available on the Integrated Systems Console Welcome 
page.

If an affected version is present, apply the updated fix identified below
or upgrade to WAS version 7.0.0.31 or higher as soon as possible (see Security
Bulletin 1663938: Multiple vulnerabilities in current IBM SDK for Java for 
WebSphere Application Server January 2014 CPU for more details on upgrade 
versions).

Affected ISDS versions 	WebSphere Application Server Version 	Fixed Java Version 	APAR fix

6.1 			6.1.0.0 				SDK 5 SR16 FP5 		PI08999

6.2 			6.1.0.0 				SDK 5 SR16 FP5 		PI08999

6.3 			7.0.0.0 				SDK 6 SR15 FP1 		PI08996

6.3.1 			7.0.0.0 				SDK 6 SR15 FP1 		PI08996

Workarounds and Mitigations

None

References

Complete CVSS Guide

On-line Calculator V2

CVE-2014-0411

http://xforce.iss.net/xforce/xfdb/90357

http://www-01.ibm.com/support/docview.wss?uid=swg21663938

Related information

IBM Secure Engineering Web Portal

IBM Product Security Incident Response Blog

Change History

None

*The CVSS Environment Score is customer environment specific and will 
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the 
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the 
Common Vulnerability Scoring System (CVSS) is an "industry open standard 
designed to convey vulnerability severity and help to determine urgency and 
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY 
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT 
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBUy/T0hLndAQH1ShLAQJTLRAAtelV43kAKdvQFWvLF9idG+YJW3api6iv
r08AAMi0MgUEHY5sejgqYSCQu0xi+BXLedoduw1CWqFaCLxeJz7HuBuVyhubl+Ra
R+jrFTkp5WdF7jiGAhwSLD48P/7cCjEsczgSKNyezpJTGk2eMwr0RUOhcT5CAkRt
LBo9bpk56OL9ddHiezLkRA2FYDdKiJjAqJcWGzcjNcR0ys3ZEQoahc65+a+/yGRD
YAol8c3x6HRC7XaLurfcDVA1hlDiTPRxN0hsSVW3bpYmnkjvZ9ihgYy7SZbQ0JN1
pDgo/UXRrp76Hvlc4Ngr3Dx+O1MNP8YiGIVpkFM33iICgoIUrkmY7VAzxTTtewFM
heQuvn6bIrG1GRwjCKvV+O+Mcc6Gq1xyEbsPdN3PwZ5oKrQ98sIVq0I5CuXn6WpE
oufEG0j1YzvuEivgIK8w4SsIfsYaTHxa6H6M4GYKUD7+N+nvqU35/qQUIKtNu0wJ
km8xxP9U1QFoKrKKF8LzW075njoOMscA+ROkYQiiDOymwZhkSLqUqyYEaPDPHhe0
4d3YH0cpEV6lT1sqB68FcTyAmv7R9vqU8v2p70j08Ue5+GMJbniM++/Sf1hePWfa
aOkPClTgR9OloYa6xdb0Rq96unHnJj7uqcrelKHV/soc+vxNZx8XtvtIXLteQRMs
n34PJdwuPXo=
=LykI
-----END PGP SIGNATURE-----