IBM SECURITY ADVISORY First Issued: Tue Jul 12 14:14:43 CDT 2016 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/openssl_advisory20.asc https://aix.software.ibm.com/aix/efixes/security/openssl_advisory20.asc ftp://aix.software.ibm.com/aix/efixes/security/openssl_advisory20.asc Security Bulletin: Vulnerabilities in OpenSSL affect AIX (CVE-2016-2176 CVE-2016-2109 CVE-2016-2108 CVE-2016-2106 CVE-2016-2105) =============================================================================== SUMMARY: This bulletin addresses CVE-2016-2176 CVE-2016-2109 CVE-2016-2108 CVE-2016-2106 CVE-2016-2105 for AIX. =============================================================================== VULNERABILITY DETAILS: CVEID: CVE-2016-2176 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, by sending an overly long ASN.1 string to the X509_NAME_oneline() function. An attacker could exploit this vulnerability to return arbitrary stack data in the buffer. CVSS Base Score: 5.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112858 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:P) CVEID: CVE-2016-2109 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a memory allocation error. By reading specially crafted ASN.1 data from a BIO using functions such as d2i_CMS_bio(), an attacker could exploit this vulnerability to consume all available resources and exhaust memory. CVSS Base Score: 5.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112857 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:C) CVEID: CVE-2016-2108 DESCRIPTION: OpenSSL could allow a remote attacker to execute arbitrary code on the system, caused by a buffer underflow when deserializing untrusted ASN.1 structures and later reserializes them. An attacker could exploit this vulnerability to corrupt memory and trigger an out-of-bounds write and execute arbitrary code on the system. CVSS Base Score: 8.1 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112853 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVEID: CVE-2016-2106 DESCRIPTION: OpenSSL is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the EVP_EncryptUpdate() function. By sending an overly long argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. CVSS Base Score: 5.6 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112856 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVEID: CVE-2016-2105 DESCRIPTION: OpenSSL is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the EVP_EncodeUpdate() function. By sending an overly long argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. CVSS Base Score: 5.6 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112855 for the current score CVSS Environmental Score*: Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P) AFFECTED PRODUCTS AND VERSIONS: AIX 5.3, 6.1, 7.1, 7.2 VIOS 2.2.x The following fileset levels are vulnerable: key_fileset = osrcaix Fileset Lower Level Upper Level KEY -------------------------------------------------- openssl.base 0.9.8.401 0.9.8.2506 key_w_fs openssl.base 1.0.1.500 1.0.1.515 key_w_fs openssl.base 1.0.2.500 1.0.2.500 key_w_fs openssl.base 12.9.8.1100 12.9.8.2506 key_w_fs openssl.base 20.11.101.500 20.11.101.500 key_w_fs Note, 0.9.8.401 and 12.9.8.1100 are the Lowest OpenSSL version available in aix web download site. Even OpenSSL versions below this are impacted. Note: To find out whether the affected filesets are installed on your systems, refer to the lslpp command found in AIX user's guide. Example: lslpp -L | grep -i openssl.base REMEDIATION: A. FIXES A fix is available, and it can be downloaded from: https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=aixbp To extract the fixes from the tar file: For Openssl 1.0.1 version - zcat openssl-1.0.1.516.tar.Z | tar xvf - For Openssl 0.9.8 version - zcat openssl-0.9.8.2507.tar.Z | tar xvf - For Openssl 12.9.8 version - zcat openssl-12.9.8.2507.tar.Z | tar xvf - For Openssl 1.0.2 version - zcat openssl-1.0.2.800.tar.Z | tar xvf - For Openssl 20.11.101 version - zcat openssl-20.11.101.501.tar.Z | tar xvf - IMPORTANT: If possible, it is recommended that a mksysb backup of the system be created. Verify it is both bootable and readable before proceeding. Note that all the previously reported security vulnerability fixes is also included in above mentioned fileset level. Please refer to the readme file (provided along with the fileset) for the complete list of vulnerabilities fixed. To preview the fix installation: installp -apYd . openssl To install the fix package: installp -aXYd . openssl openssl dgst -sha1 -verify -signature .sig openssl dgst -sha1 -verify -signature .sig Published advisory OpenSSL signature file location: http://aix.software.ibm.com/aix/efixes/security/openssl_advisory20.asc.sig https://aix.software.ibm.com/aix/efixes/security/openssl_advisory20.asc.sig ftp://aix.software.ibm.com/aix/efixes/security/openssl_advisory20.asc.sig WORKAROUNDS AND MITIGATIONS: None. =============================================================================== CONTACT US: Note: Keywords labeled as KEY in this document are used for parsing purposes. If you would like to receive AIX Security Advisories via email, please visit "My Notifications": http://www.ibm.com/support/mynotifications To view previously issued advisories, please visit: http://www14.software.ibm.com/webapp/set2/subscriptions/onvdq Comments regarding the content of this announcement can be directed to: security-alert@austin.ibm.com To obtain the OpenSSL public key that can be used to verify the signed advisories and ifixes: Download the key from our web page: http://www.ibm.com/systems/resources/systems_p_os_aix_security_pubkey.txt To obtain the PGP public key that can be used to communicate securely with the AIX Security Team via security-alert@austin.ibm.com you can : A. Download the key from our web page: http://www.ibm.com/systems/resources/systems_p_os_aix_security_pgppubkey.txt B. Download the key from a PGP Public Key Server. The key ID is: 0x28BFAA12 Please contact your local IBM AIX support center for any assistance. REFERENCES: Note: Keywords labeled as KEY in this document are used for parsing purposes. eServer is a trademark of International Business Machines Corporation. IBM, AIX and pSeries are registered trademarks of International Business Machines Corporation. All other trademarks are property of their respective holders. Complete CVSS Guide: http://www.first.org/cvss/cvss-guide.html On-line Calculator V2: http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2 X-Force Vulnerability Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/112858 X-Force Vulnerability Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/112857 X-Force Vulnerability Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/112853 X-Force Vulnerability Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/112856 X-Force Vulnerability Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/112855 CVE-2016-2176 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2176 CVE-2016-2109 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2109 CVE-2016-2108 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2108 CVE-2016-2106 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2106 CVE-2016-2105 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2105 ACKNOWLEDGEMENTS: None. CHANGE HISTORY: First Issued: Tue Jul 12 14:14:43 CDT 2016 =============================================================================== *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin. Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.