-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2016.0278
              Vulnerabilities in IBM Security Access Manager
                              4 February 2016

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IBM Security Access Manager
Publisher:         IBM
Operating System:  UNIX variants (UNIX, Linux, OSX)
                   Windows
                   Network Appliance
Impact/Access:     Access Privileged Data         -- Remote/Unauthenticated
                   Provide Misleading Information -- Remote/Unauthenticated
                   Reduced Security               -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2016-0201 CVE-2015-7575 CVE-2015-5010

Reference:         ASB-2016.0004
                   ESB-2016.0255
                   ESB-2016.0219
                   ESB-2016.0211
                   ESB-2016.0207
                   ESB-2016.0206
                   ESB-2016.0176

Original Bulletin: 
   http://www.ibm.com/support/docview.wss?uid=swg21974452
   http://www.ibm.com/support/docview.wss?uid=swg21974639
   http://www.ibm.com/support/docview.wss?uid=swg21970508
   http://www.ibm.com/support/docview.wss?uid=swg21974637
   http://www.ibm.com/support/docview.wss?uid=swg21974389

- --------------------------BEGIN INCLUDED TEXT--------------------

Security Bulletin: A vulnerability in the GSKit component of IBM Security
Access Manager for Mobile (CVE-2016-0201)

Security Bulletin

Document information

More support for:

IBM Security Access Manager for Mobile

Software version:

8.0, 8.0.0.1, 8.0.0.2, 8.0.0.3, 8.0.0.4, 8.0.0.5, 8.0.1, 8.0.1.2, 8.0.1.3,
9.0

Operating system(s):

Platform Independent

Reference #:

1974452

Modified date:

2016-02-02

Summary

A vulnerability has been addressed in the GSKit component of IBM Security
Access Manager for Mobile.

Vulnerability Details

CVEID:

CVE-2016-0201

DESCRIPTION:

IBM GSKit could allow a remote attacker to obtain sensitive information,
caused by a MD5 collision. An attacker could exploit this vulnerability to
obtain authentication credentials.

CVSS Base Score: 5.9

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/109310

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

IBM Security Access Manager for Mobile 8.0 appliances, all firmware versions

IBM Security Access Manager 9.0 appliances, all firmware versions

Remediation/Fixes

The table below provides links to patches for all affected versions. Follow
the installation instructions in the README file included with the patch.

Product                                 VRMF           APAR     Remediation
IBM Security Access Manager for Mobile  8.0 - 8.0.1.3  IV80771  1. For 8.0-8.0.1.2 environments, upgrade to 8.0.1.3:
                                                                8.0.1-ISS-ISAM-FP0003
2. Apply 8.0.1.3 Interim Fix 4:
8.0.1.3-ISS-ISAM-IF0004
IBM Security Access Manager             9.0 - 9.0.0.1  IV80132  1. For 9.0 environments, upgrade to 9.0.0.1:
                                                                9.0.0-ISS-ISAM-FP0001
2. Apply 9.0.0.1 Interim Fix 1:
9.0.0.1-ISS-ISAM-IF0001

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support
alerts like this.

References

Complete CVSS v3 Guide

On-line Calculator v3

Related information

IBM Secure Engineering Web Portal

IBM Product Security Incident Response Blog

Change History

February 1, 2016: Original version published

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- ---------------------------------------------------------------------------

Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects
IBM Security Access Manager for Mobile (CVE-2015-7575)

Security Bulletin

Document information

More support for:

IBM Security Access Manager for Mobile

Software version:

8.0, 8.0.0.1, 8.0.0.2, 8.0.0.3, 8.0.0.4, 8.0.0.5, 8.0.1, 8.0.1.2, 8.0.1.3,
9.0

Operating system(s):

Platform Independent

Reference #:

1974639

Modified date:

2016-02-02

Summary

The MD5 SLOTH vulnerability on TLS 1.2 affects IBM Security Access Manager
for Mobile.

Vulnerability Details

CVEID:

CVE-2015-7575

DESCRIPTION:

The TLS protocol could allow weaker than expected security caused by a
collision attack when using the MD5 hash function for signing a
ServerKeyExchange message during a TLS handshake. An attacker could exploit
this vulnerability using man-in-the-middle techniques to impersonate a TLS
server and obtain credentials.

CVSS Base Score: 7.1

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/109415

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)

Affected Products and Versions

IBM Security Access Manager for Mobile 8.0 appliances, all firmware versions

IBM Security Access Manager 9.0 appliances, all firmware versions

Remediation/Fixes

The table below provides links to patches for all affected versions. Follow
the installation instructions in the README file included with the patch.

Product                                 VRMF           APAR     Remediation
IBM Security Access Manager for Mobile  8.0 - 8.0.1.3  IV80756  1. For 8.0-8.0.1.2 environments, upgrade to 8.0.1.3:
                                                       IV80758  8.0.1-ISS-ISAM-FP0003
                                                                2. Apply 8.0.1.3 Interim Fix 4:
8.0.1.3-ISS-ISAM-IF0004
IBM Security Access Manager             9.0 - 9.0.0.1  IV80663  1. For 9.0 environments, upgrade to 9.0.0.1:
                                                       IV80676  9.0.0-ISS-ISAM-FP0001
                                                                2. Apply 9.0.0.1 Interim Fix 1:
9.0.0.1-ISS-ISAM-IF0001


Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support
alerts like this.

References

Complete CVSS v3 Guide

On-line Calculator v3

Related information

IBM Secure Engineering Web Portal

IBM Product Security Incident Response Blog

Acknowledgement

Reported to IBM by Karthikeyan Bhargavan at INRIA in Paris, France

Change History

February 1, 2016: Original version published.

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- -------------------------------------------------------------------------

Security Bulletin: IBM Security Access Manager for Web does not enforce
account lockouts (CVE-2015-5010)

Security Bulletin

Document information

More support for:

IBM Security Access Manager for Web

Software version:

7.0, 8.0, 8.0.0.2, 8.0.0.4, 8.0.0.5, 8.0.1, 8.0.1.2, 8.0.1.3, 9.0

Operating system(s):

Appliance

Reference #:

1970508

Modified date:

2016-02-02

Summary

IBM Security Access Manager for Web does not enforce account lockouts after a
certain number of failed login attempts. A remote attacker could use a brute
force attack to determine the login credentials for the administrator.

Vulnerability Details

CVEID:

CVE-2015-5010

DESCRIPTION:

IBM Security Access Manager for Web does not enforce account lockouts after a
certain number of failed login attempts. A remote attacker could use a brute
force attack to determine the login credentials for the administrator.

CVSS Base Score: 7.5

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/106373

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

IBM Security Access Manager for Web 7.0 (appliance), all firmware versions

IBM Security Access Manager for Web 8.0, all firmware versions

IBM Security Access Manager 9.0, all firmware versions

Remediation/Fixes

The table below provides links to patches for all affected versions. Follow
the installation instructions in the README file included with the patch.

Product name                         VRMF            APAR               Remediation
IBM Security Access Manager for Web  7.0 - 7.0.0.20  IV80728            1. Apply Interim Fix 21:
                                                     (appliance-based)  7.0.0-ISS-WGA-IF0021
IBM Security Access Manager for Web  8.0 - 8.0.1.3   IV80694            1. For 8.0-8.0.1.2 environments, upgrade to 8.0.1.3:
                                                                        8.0.1-ISS-WGA-FP0003
2. Apply 8.0.1.3 Interim Fix 4:
8.0.1.3-ISS-WGA-IF0004
IBM Security Access Manager          9.0 - 9.0.0.1   IV80694            1. For 9.0 environments, upgrade to 9.0.0.1:
                                                                        9.0.0-ISS-ISAM-FP0001
2. Apply 9.0.0.1 Interim Fix 1:
9.0.0.1-ISS-ISAM-IF0001

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support
alerts like this.

References

Complete CVSS v3 Guide

On-line Calculator v3

Related information

IBM Secure Engineering Web Portal

IBM Product Security Incident Response Blog

Change History

February 1, 2016: Original version published

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- -------------------------------------------------------------------------

Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects
IBM Security Access Manager for Web (CVE-2015-7575)

Security Bulletin

Document information

More support for:

IBM Security Access Manager for Web

Software version:

7.0, 8.0, 8.0.0.2, 8.0.0.4, 8.0.0.5, 8.0.1, 8.0.1.2, 8.0.1.3, 9.0

Operating system(s):

Appliance

Reference #:

1974637

Modified date:

2016-02-02

Summary

The MD5 SLOTH vulnerability on TLS 1.2 affects IBM Security Access Manager
for Web.

Vulnerability Details

CVEID:

CVE-2015-7575

DESCRIPTION:

The TLS protocol could allow weaker than expected security caused by a
collision attack when using the MD5 hash function for signing a
ServerKeyExchange message during a TLS handshake. An attacker could exploit
this vulnerability using man-in-the-middle techniques to impersonate a TLS
server and obtain credentials.

CVSS Base Score: 7.1

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/109415

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)

Affected Products and Versions

IBM Security Access Manager for Web 7.0 appliances, all firmware versions

IBM Security Access Manager for Web 8.0 appliances, all firmware versions

IBM Security Access Manager 9.0 appliances, all firmware versions

Remediation/Fixes

The table below provides links to patches for all affected versions. Follow
the installation instructions in the README file included with the patch.

Product                              VRMF                         APAR     Remediation
IBM Security Access Manager for Web  7.0 - 7.0.0.20 (appliances)  IV80680  1. Apply Interim Fix 21:
                                                                           7.0.0-ISS-WGA-IF0021
IBM Security Access Manager for Web  8.0 - 8.0.1.3                IV80663  1. For 8.0-8.0.1.2 environments, upgrade to 8.0.1.3:
                                                                  IV80676  8.0.1-ISS-WGA-FP0003
                                                                           2. Apply 8.0.1.3 Interim Fix 4:8.0.1.3-ISS-WGA-IF0004
IBM Security Access Manager          9.0 - 9.0.0.1                IV80663  1. For 9.0 environments, upgrade to 9.0.0.1:
                                                                  IV80676  9.0.0-ISS-ISAM-FP0001
                                                                           2. Apply 9.0.0.1 Interim Fix 1:
9.0.0.1-ISS-ISAM-IF0001

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support
alerts like this.

References

Complete CVSS v3 Guide

On-line Calculator v3

Related information

IBM Secure Engineering Web Portal

IBM Product Security Incident Response Blog

Acknowledgement

Reported to IBM by Karthikeyan Bhargavan at INRIA in Paris, France

Change History

February 1, 2016: Original version published

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- ----------------------------------------------------------------------

Security Bulletin: A security vulnerability has been identified in the GSKit
component of IBM Security Access Manager for Web (CVE-2016-0201)

Security Bulletin

Document information

More support for:

IBM Security Access Manager for Web

Software version:

7.0, 8.0, 8.0.0.2, 8.0.0.4, 8.0.0.5, 8.0.1, 8.0.1.2, 8.0.1.3, 9.0

Operating system(s):

Platform Independent

Reference #:

1974389

Modified date:

2016-02-02

Summary

A vulnerability has been addressed in the GSKit component of IBM Security
Access Manager for Web.

Vulnerability Details

CVEID:

CVE-2016-0201

DESCRIPTION:

IBM GSKit could allow a remote attacker to obtain sensitive information,
caused by a MD5 collision. An attacker could exploit this vulnerability to
obtain authentication credentials.

CVSS Base Score: 5.9

CVSS Temporal Score: See

https://exchange.xforce.ibmcloud.com/vulnerabilities/109310

for the current score

CVSS Environmental Score*: Undefined

CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

IBM Security Access Manager for Web 7.0 (software)

IBM Security Access Manager for Web 7.0 appliances, all firmware versions

IBM Security Access Manager for Web 8.0 appliances, all firmware versions

IBM Security Access Manager 9.0 appliances, all firmware versions

Remediation/Fixes

The table below provides links to patches for all affected versions. Follow
the installation instructions in the README file included with the patch.

Product                                                VRMF                                     APAR     Remediation
IBM Security Access Manager for Web                    7.0 - 7.0.0.20 (software installations)  IV80755  1. Apply Interim Fix 21:
                                                                                                         7.0.0-ISS-SAM-IF0021
IBM Security Access Manager for Web                    7.0 - 7.0.0.20 (appliances)              IV80755  1. Apply Interim Fix 21:
                                                                                                         7.0.0-ISS-WGA-IF0021
IBM Security Access Manager for Web                    8.0 - 8.0.1.3                            IV80132  1. For 8.0-8.0.1.2 environments, upgrade to 8.0.1.3:
                                                                                                         8.0.1-ISS-WGA-FP0003
2. Apply 8.0.1.3 Interim Fix 4:8.0.1.3-ISS-WGA-IF0004
IBM Security Access Manager                            9.0 - 9.0.0.1                            IV80132  1. For 9.0 environments, upgrade to 9.0.0.1:
                                                                                                         9.0.0-ISS-ISAM-FP0001
2. Apply 9.0.0.1 Interim Fix 1:
9.0.0.1-ISS-ISAM-IF0001

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support
alerts like this.

References

Complete CVSS v3 Guide

On-line Calculator v3

Related information

IBM Secure Engineering Web Portal

IBM Product Security Incident Response Blog

Acknowledgement

None.

Change History

February 1, 2016: Original version published

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVrKjLn6ZAP0PgtI9AQLrmw//RiTTJ/DAF2wOtkYPjsHE5WDyOKW7C+FE
qLl8+QxN/deKsxoERXEZBW1cYehSKPzqkDHCdfCc3Ehs/VWtjNh4XacJtjYR3q1Z
UtdgGz9qolT2cCrhNny8Q40D43qTfrFrPZzCzebTJQtl0V4jsFxWPbuVLQd32igu
Rgv0qwXKn2G18Ru2L5j2Uee3ukG2s3bSNicDjRHLcliIjF6MwQaaDM8NOp6S1y/+
FjjLompB12GkHfY5pEI+ChnCgOch7evIlFbjJEbWdeIJB/YwvT1mbnVRlq2x/SdN
0SzvOklkqji71E2sQRqUZiycbNS0fP942Uw4JY6dhlvr/ZIxYZUtp7sN0XWKi+BU
iC5RyWssdz5Y+1Zgj1XiQCVGV1N5o++dxDLQrE+ofOmRNur+gTSRCyeM7IyTrJXH
e+/lizAKyQQx9JT1XB7Vuuo8rB0tldnnyop8sOvayOdRnPgtyLRxWBKFKJ2C4MRp
jTM6kNLMAkFpnI3tbUgiGSHqfKaZs2vJwEaDk6c1lG+6NHZuAFDopum9gN75EUIV
pMNWjbHWD1Mrn4uJT87JENE72kzIssN3stONF6OhTcNeJuL8h/ZsSrz0W2HHeRSU
rVUcO+7V4BpFqoASL8tbbMRqs9lxXGlxjZUcApLWcF170ZNwYKSYLacqX997DG65
kcNSPy84IFU=
=BNDz
-----END PGP SIGNATURE-----