IBM SECURITY ADVISORY

First Issued: Tue Sep  5 14:51:45 CDT 2017

The most recent version of this document is available here:

http://aix.software.ibm.com/aix/efixes/security/itds_advisory.asc
https://aix.software.ibm.com/aix/efixes/security/itds_advisory.asc
ftp://aix.software.ibm.com/aix/efixes/security/itds_advisory.asc

Security Bulletin: Vulnerability in GSKit affects IBM Tivoli Directory Server
 and IBM Security Directory Server for AIX (CVE-2016-2183)

===============================================================================

SUMMARY:

 There is a vulnerability in GSKit that impacts IBM Tivoli Directory Server
 and IBM Security Directory Server for AIX.

===============================================================================

VULNERABILITY DETAILS:

CVEID: CVE-2016-2183
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2183
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2183
DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive 
information, caused by an error in the DES/3DES cipher, used as a part of the 
SSL/TLS protocol. By capturing large amounts of encrypted traffic between the 
SSL/TLS server and the client, a remote attacker able to conduct a 
man-in-the-middle attack could exploit this vulnerability to recover the 
plaintext data and obtain sensitive information. This vulnerability is known 
as the SWEET32 Birthday attack.
CVSS Base Score: 3.7
CVSS Temporal Score: See 
https://exchange.xforce.ibmcloud.com/vulnerabilities/116337 for the current 
score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)


    AFFECTED PRODUCTS AND VERSIONS:

        AIX 5.3, 6.1, 7.1, 7.2
        VIOS 2.2.x

        The following levels are vulnerable if the respective IBM Tivoli
        Directory Server or IBM Security Directory Server version is 
        installed:
        For ITDS 6.2:     Less than 6.2.0.52
        For ITDS 6.3.0:   Less than 6.3.0.45
        For ISDS 6.3.1:   Less than 6.3.1.20
        For ISDS 6.4.0:   Less than 6.4.0.11
        
        Note: To find out whether the affected ITDS or ISDS filesets are  
        installed on your systems, refer to the lslpp command found in AIX
        user's guide.

        Example:  lslpp -L | grep -i itds


    REMEDIATION:

        Latest fix for all APARs related to Tivoli Directory Server 6.2,
        upgrading to 6.2.0.52 or later:
    https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Security%2BSystems&product=ibm/Tivoli/Tivoli+Directory+Server&release=6.2.0.52&platform=AIX&function=all

        Latest fix for all APARs related to Tivoli Directory Server 6.3.0,
        upgrading to 6.3.0.45 or later:
    https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Security%2BSystems&product=ibm/Tivoli/Tivoli+Directory+Server&release=6.3.0.45&platform=AIX&function=all

        Latest fix for all APARs related to Tivoli Directory Server 6.3.1,
        upgrading to 6.3.1.20 or later:
    https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Security%2BSystems&product=ibm/Tivoli/IBM+Security+Directory+Server&release=6.3.1.20&platform=AIX&function=all

        Latest fix for all APARs related to Tivoli Directory Server 6.4.0,
        upgrading to 6.4.0.11 or later:
    https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Security%2BSystems&product=ibm/Tivoli/IBM+Security+Directory+Server&release=6.4.0.11&platform=AIX&function=all


    WORKAROUNDS AND MITIGATIONS:

        None.

===============================================================================

CONTACT US:

    If you would like to receive AIX Security Advisories via email,
    please visit "My Notifications":

        http://www.ibm.com/support/mynotifications

    To view previously issued advisories, please visit:

        http://www14.software.ibm.com/webapp/set2/subscriptions/onvdq
 
    Contact IBM Support for questions related to this announcement:

        http://ibm.com/support/
        https://ibm.com/support/

    To obtain the OpenSSL public key that can be used to verify the
    signed advisories and ifixes:

        Download the key from our web page:

    http://www.ibm.com/systems/resources/systems_p_os_aix_security_pubkey.txt

    Please contact your local IBM AIX support center for any
    assistance.


REFERENCES:
 
    Complete CVSS v2 Guide:
        http://www.first.org/cvss/v2/guide 
    On-line Calculator v2:
        http://nvd.nist.gov/CVSS-v2-Calculator 
    Complete CVSS v3 Guide:
        http://www.first.org/cvss/user-guide 
    On-line Calculator v3:
        http://www.first.org/cvss/calculator/3.0 


ACKNOWLEDGEMENTS:

    None.


CHANGE HISTORY:

    First Issued: Tue Sep  5 14:51:45 CDT 2017 
     
===============================================================================

*The CVSS Environment Score is customer environment specific and will 
ultimately impact the Overall CVSS Score. Customers can evaluate the impact 
of this vulnerability in their environments by accessing the links in the 
Reference section of this Security Bulletin. 

Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the 
Common Vulnerability Scoring System (CVSS) is an "industry open standard 
designed to convey vulnerability severity and help to determine urgency and 
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY 
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT 
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.