-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2015.0436
Security Bulletin: Vulnerabilities in OpenSSL affects Rational Application
      Developer for WebSphere Software (CVE-2014-3570, CVE-2014-3571,
 CVE-2014-3572,CVE-2014-8275, CVE-2015-0204, CVE-2015-0205, CVE-2015-0206)
                             24 February 2015

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IBM Rational Application Developer for WebSphere Software
Publisher:         IBM
Operating System:  Linux variants
                   OS X
                   Windows
Impact/Access:     Denial of Service              -- Remote/Unauthenticated
                   Provide Misleading Information -- Remote/Unauthenticated
                   Access Confidential Data       -- Remote/Unauthenticated
                   Reduced Security               -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2015-0206 CVE-2015-0205 CVE-2015-0204
                   CVE-2014-8275 CVE-2014-3572 CVE-2014-3571
                   CVE-2014-3570  

Reference:         ESB-2015.0048.2

Original Bulletin: 
   http://www-01.ibm.com/support/docview.wss?uid=swg21697140

- --------------------------BEGIN INCLUDED TEXT--------------------

Security Bulletin: Vulnerabilities in OpenSSL affects Rational Application 
Developer for WebSphere Software (CVE-2014-3570, CVE-2014-3571, CVE-2014-3572,
CVE-2014-8275, CVE-2015-0204, CVE-2015-0205, CVE-2015-0206) 

Security Bulletin

Document information

More support for:

Rational Application Developer for WebSphere Software

Cordova

Software version:

9.1, 9.1.0.1, 9.1.1

Operating system(s):

Linux, OS X, Windows

Reference #:

1697140

Modified date:

2015-02-20

Summary

OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL 
Project. OpenSSL is used by the Cordova platform packaged with Rational 
Application Developer for WebSphere Software and has addressed the applicable
CVEs.

Vulnerability Details

CVEID:CVE-2014-3570

Description: An unspecified error in OpenSSL related to the production of 
incorrect results on some platforms by Bignum squaring (BN_sqr) has an unknown
attack vector and impact.

CVSS Base Score: 2.6

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/99710 for the 
current score

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:H/Au:N/C:N/I:P/A:N)

CVEID:CVE-2014-3571

Description: OpenSSL is vulnerable to a denial of service, caused by a NULL 
pointer dereference when handling malicious messages. By sending a 
specially-crafted DTLS message, a remote attacker could exploit this 
vulnerability to cause a segmentation fault.

CVSS Base Score: 5

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/99703 for the 
current score

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID:CVE-2014-3572

Description: OpenSSL could provide weaker than expected security. The client 
accepts a handshake using an ephemeral ECDH ciphersuite with the server key 
exchange message omitted. An attacker could exploit this vulnerability to 
launch further attacks on the system.

CVSS Base Score: 1.2

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/99705 for the 
current score

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:L/AC:H/Au:N/C:N/I:P/A:N)

CVEID:CVE-2014-8275

Description: OpenSSL could allow a local attacker to bypass security 
restrictions, caused by the modification of the fingerprint without breaking 
the signature. An attacker could exploit this vulnerability using non-DER or 
invalid encodings outside the signed portion of a certificate bypass security
restrictions and perform unauthorized actions.

CVSS Base Score: 1.2

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/99709 for the 
current score

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:L/AC:H/Au:N/C:N/I:P/A:N)

CVEID:CVE-2015-0204

Description: OpenSSL could provide weaker than expected security. The client 
accepts the use of an RSA temporary key in a non-export RSA key exchange 
ciphersuite. An attacker could exploit this vulnerability to launch further 
attacks on the system.

CVSS Base Score: 1.2

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/99707 for the 
current score

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:L/AC:H/Au:N/C:N/I:P/A:N)

CVEID:CVE-2015-0205

Description: OpenSSL could allow a remote authenticated attacker to bypass 
security restrictions, caused by the acceptance of a DH certificate for client
authentication without verification. An attacker could exploit this 
vulnerability to authenticate without the use of a private key.

CVSS Base Score: 2.1

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/99708 for the 
current score

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:H/Au:S/C:N/I:P/A:N)

CVEID:CVE-2015-0206

Description: OpenSSL is vulnerable to a denial of service, caused by a memory
leak in the dtls1_buffer_record function. By sending repeated DTLS records 
with the same sequence number, a remote attacker could exploit this 
vulnerability to exhaust all available memory resources

CVSS Base Score: 5

CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/99704 for the 
current score

CVSS Environmental Score*: Undefined

CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Affected Products and Versions

IBM Rational Application Developer for WebSphere Software 9.1, 9.1.0.1, and 
9.1.1

Remediation/Fixes

Update the IBM SDK for Node.js using by the Cordova platform in the product to
address this vulnerability:

Product 			VRMF 			APAR Remediation/First Fix

Rational Application Developer 	9.1, 9.1.0.1, and 9.1.1	     Apply IBM SDK for Node.js 1.1.0.12 to the Cordova platform in the product.

							     Installation instructions for applying the update to the Cordova platform
						             in the product can be found here:

							     Upgrading the IBM SDK for Node.js used by Cordova

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support 
alerts like this.

References

Complete CVSS Guide

On-line Calculator V2

OpenSSL Project vulnerability website

Related information

IBM Secure Engineering Web Portal

IBM Product Security Incident Response Blog

Acknowledgement

None

Change History

* 20 February 2015: Original copy published

*The CVSS Environment Score is customer environment specific and will 
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the 
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the 
Common Vulnerability Scoring System (CVSS) is an "industry open standard 
designed to convey vulnerability severity and help to determine urgency and 
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY 
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT 
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVOwG+RLndAQH1ShLAQJx2w//Ria9UnpxPbcVnU/WuzwDFuF6f8QEKQCX
ve649kuEHbhaQPsKWh0KY0B4osHbp2s8bqwEKf4bphHtc5nSaYQMcjBhgudJLvfz
jjSSx1zfHstDLSUyKSwa+QxWmxcNbHo8Myl905tJ1iFAPMcm1b3m+jxg9getV3Jc
GHNhrtA7lodlGiS8MI48E7bm/Mmb1LDhN7PeKZmMQIYljpLveMzyy6+xmXCsOQ1j
SuI0nnoZEwtpZgzJ1J5WvOxa8qOWarxnItgJnhDZ+zdEYg2ehfa0eEISUZWUoOWo
I/4v1mKTpuxEDNM1STLGYVtdbWWSTesgpIv/Igsw5LYH6L1PMpMPGBh1JrhaXhPh
YmfpoXHLS9A/exGdyZ0T9QQumhzV6eJ2NsiyRaFtRtNoJfsT/y7LzJGWvwWaJfVt
GASmtPvt+O7UCvd8dprn3bguXOaPYTU9AMxkF6GwQPnWxrPi1q1bfIulZyyFhplH
MHGWQpG8MCPgLmdVpUOmkse6Log/r5PSyH5MDSEqAr57kHzGj1PtFYCYLoGiG40y
H51OEFsbfdcw7au8BWe0WeilbdwoTnRBcoGkLotLUrMjQoY2unoXW4uj/SolyxSj
/lZXjRxfL9ZWLUNYNxiKqFrBzeWqUp2zNuknzJQ7TCwC6ZjwnjocPILXUOJ1FYte
N9Bwh74ERqo=
=EoT8
-----END PGP SIGNATURE-----