-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2016.1070
       Security Bulletin: Vulnerabilities in Open SSL affect Watson
                Explorer (CVE-2016-0701 and CVE-2015-3197)
                                3 May 2016

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IBM Watson Explorer
Publisher:         IBM
Operating System:  Linux variants
                   Windows
Impact/Access:     Reduced Security -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2016-0701 CVE-2015-3197 

Reference:         ASB-2016.0043
                   ESB-2016.0250

Original Bulletin: 
   http://www.ibm.com/support/docview.wss?uid=swg21982336

- --------------------------BEGIN INCLUDED TEXT--------------------

Security Bulletin: Vulnerabilities in Open SSL affect Watson Explorer
(CVE-2016-0701 and CVE-2015-3197)

Security Bulletin

Document information

More support for:

Watson Explorer

Software version:

8.2.0, 9.0.0, 9.0.0.1, 9.0.0.2, 9.0.0.3, 9.0.0.4, 9.0.0.5, 9.0.0.6, 10.0.0,
10.0.0.1, 10.0.0.2, 11.0.0, 11.0.0.1, 11.0.0.2

Operating system(s):

Linux, Windows

Software edition:

All Editions

Reference #:

1982336

Modified date:

2016-04-28

Summary

Two vulnerabilities in OpenSSL affect Watson Explorer.

Vulnerability Details

CVEID:

CVE-2016-0701

DESCRIPTION:

The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before
1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman
(DH) key exchange, which makes it easier for remote attackers to discover a
private DH exponent by making multiple handshakes with a peer that chose an
inappropriate number, as demonstrated by a number in an X9.42 file.

CVSS Base Score: 3.7

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/110234

for the current score.

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:

CVE-2015-3197

DESCRIPTION:

ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not
prevent use of disabled ciphers, which makes it easier for man-in-the-middle
attackers to defeat cryptographic protection mechanisms by performing
computations on SSLv2 traffic, related to the get_client_master_key and
get_client_hello functions.

CVSS Base Score: 5.9

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/110235

for the current score.

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

These vulnerabilities apply to the following products and versions:

Watson Explorer Foundational Components versions 11.0.0.0 - 11.0.0.2

Watson Explorer Foundational Components versions 10.0.0.0 - 10.0.0.2

Watson Explorer Foundational Components versions 9.0.0.0 - 9.0.0.6

InfoSphere Data Explorer versions 8.2 - 8.2-4

Remediation/Fixes

Follow these steps to upgrade to the required version of OpenSSL. The table
reflects product names at the time the specified versions were released. To
use the links to Fix Central in this table, you must first log in to the IBM
Support: Fix Central site at

http://www.ibm.com/support/fixcentral/

Affected Product				Affected Versions	Fix
Watson Explorer Foundational Components         11.0.0.0 - 11.0.0.2  	Upgrade to Version 11.0.0.2

									See Watson Explorer Version 11.0.0.2 Foundational Components for download information and instructions.

Watson Explorer Foundational Components         10.0.0.0 - 10.0.0.2  	Upgrade to Version 10.0.0.2 (if necessary), then apply the 10.0.0.2 interim fix.
                                                                        1. If not already installed, upgrade to version 10.0.0.2. See Watson Explorer 10.0.0.2 Foundational Components for download information and instructions.          
									2. Download the 10.0.0.2 interim fix for your edition of Watson Explorer from Fix Central.          
									3. Place the interim fix zip or tar file at the root of the Watson Explorer Engine installation directory.
									Default locations:
									Linux: /opt/ibm/WEX/Engine
									Windows: \Program Files\IBM\WEX\Engine          
									4. Run Engine/bin/velocity-shutdown[.exe]          
									5. Extract all files from the archive file.          
									6. Linux users should change ownership on all Engine subdirectories to their Apache user and Apache user group by running chown -R apache:apache *          
									7. Run Engine/bin/velocity-startup[.exe]

Watson Explorer Foundational Components		9.0.0.0 - 9.0.0.6	Upgrade to Version 9.0.0.6 (if necessary), then apply the 9.0.0.6 interim fix.		
									1. If not already installed, upgrade to version 9.0.0.6. Watson Explorer 9.0.0.6 can be downloaded from Fix Central.          
									2. Download the 9.0.0.6 interim fix for your edition of Watson Explorer from Fix Central.          
									3. Place the interim fix zip or tar file at the root of the Watson Explorer Engine installation directory.
									Default locations:
									Linux: /opt/ibm/IDE
									Windows: \Program Files\IBM\IDE          
									4. Run Engine/bin/velocity-shutdown[.exe]          
									5. Extract all files from the archive file.          
									6. Linux users should change ownership on all Engine subdirectories to their Apache user and Apache user group by running chown -R apache:apache *          
									7. Run Engine/bin/velocity-startup[.exe]                 
								
									Note: After installing the interim fix, the splash screen (available from Help > About) will read "9.0.0.6", while the "Release Version" below it will read "9.0.0.7". This discrepancy is to be expected.                                                                                                                                                                                                                                                                                                                                             If not already installed, upgrade to version 9.0.0.6. Watson Explorer 9.0.0.6 can be downloaded from Fix Central.          Download the 9.0.0.6 interim fix for your edition of Watson Explorer from Fix Central.          Place the interim fix zip or tar file at the root of the Watson Explorer Engine installation directory.

InfoSphere Data Explorer   			8.2 - 8.2-4		Upgrade to Version 8.2-4, then apply the 8.2-4 interim fix.
									1. If not already installed, upgrade to version 8.2-4. Watson Explorer 8.2-4 can be downloaded from Fix Central.
    									2. Download the 8.2-4 interim fix from Fix Central. Linux | Windows
    									3. Place the interim fix zip or tar file at the root of the Watson Explorer Engine installation directory.
    									Default locations:
    									Linux: /opt/IBM/IDE/Engine
    									Windows: \Program Files\IBM\IDE
    									4. Run Engine/bin/velocity-shutdown[.exe]
    									5. Extract all files from the archive file.
    									6. Linux users should change ownership on all Engine subdirectories to their Apache user and Apache user group by running chown -R apache:apache *
    									7. Run Engine/bin/velocity-startup[.exe]

									Note: After installing the interim fix, the splash screen (available from Help > About) will read "8.2-4", while the "Release Version" below it will read "8.2-5". This discrepancy is to be expected. 

Workarounds and Mitigations

None.

Get Notified about Future Security Bulletins

Subscribe to

My Notifications

to be notified of important product support alerts like this.

References

Complete CVSS v3 Guide

On-line Calculator v3

Related information

IBM Secure Engineering Web Portal

IBM Product Security Incident Response Blog

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVygviH6ZAP0PgtI9AQLTzRAAu3Wo98rJ+TI2qFbWboCJWHCEYKWENjTp
2a2JQdbGzK7OwVJSCcZq6hXw5x+ST35qn77wGB8jAEBFuazo4R86Jw6uDWO9vH7t
99tactZvJofBsv7eS8sBeTCoy1yctsJrdWYwYXFWiypwZCPaQedwhi/MFpCYQHj0
rDWIYU8b+qsWfZS5wRImCZqvn9mmbHApoehytBgcm5BnKRUaXGBuNcOcLCTfFNVO
fheUo9wstTCuTSOgSgmi1rYz6alHqkiRQ/o1fNXzxbX7Wn0frQtagIHd46+dMnpT
VPzbe6DjlOhomWOoaNHtbmmSky26QKwFa4HrYWXYNj5zBv6nQtBViq1NmWKWG5eU
vz+w0/m8zsngLI4PTiytGN8QJQh3+9b4ZBA3wkCyJTkCiH101QbvbqTdGXblWtpx
rRZuFoNiQkfJ6vFSByR0ceWZC/OMJ3QHQeqPPvno4EDL5Z416nBcpTLSpzEd5aPN
d5xw+DIzhsKZyTkqng7tWeCkTBtTA0oyk6XT9G8jZKYoiDK25CCpgQP17QzbHtHE
qStpYkbljTAiGgrw27gYWJdLtQ8gMtnkxKatY3+8aP6bRrkOElqyGvMMuATgqhYH
O/1LZtUcRBCZV5DssQOfFoypuXRdGdfY9jo2InSZLrl3MUYgVJZoJ9r6viTiajdK
vJVglXT9slU=
=Jgcj
-----END PGP SIGNATURE-----