Heartbleed, OpenSSL, and IBM i: What You Need to Know
April 14, 2014 Alex Woodie
|
Last week’s revelation of the Heartbleed security vulnerability in OpenSSL took the world’s computing community by storm. Apparently, a bug introduced more than two years ago could enable hackers to eavesdrop on Web sessions encrypted with SSL or TLS, and thereby put people’s passwords at risk. Because of the widespread use of SSL and TLS in tens of millions of websites–not to mention IBM operating systems and application code–the situation has been dubbed a computing disaster of epic proportions. The Heartbleed bug, also known as CVE-2014-0160 , was revealed to the world a week ago by security researchers at Codenomicon and Neel Mehta, who works on security for Google. A missing bounds check in the handling of the TLS heartbeat extension could enable attackers to view 64 KB of memory on a connected server. This could put user names and passwords in jeopardy for a range of network communications, including over the Web, instant messages, emails, and other systems. The good news is that the OpenSSL community fixed the problem and released the patch with OpenSSL 1.0.1g on the same day that the security vulnerability was made public. The bad news is that a critical security flaw was suddenly announced in millions of websites that had the potential to put hundreds of millions if not billions of passwords in jeopardy. Any transaction going back to December 2011 was potentially compromised. Web users have been advised to change all of their passwords for every sensitive website immediately. So, what does this mean for IBM i shops? First of all, IBM does rely on OpenSSL for several critical products, including utilities that run on IBM i operating system, WebSphere application server, and Notes/Domino products. The good news is that IBM was using an older version of OpenSSL that was not impacted by the flaw.
The main concern for IBM i shops–at least as IBM products go–appears to be the Portable Utilities for i product, or 5733-SC1 LPO, which contains the OpenSSH, OpenSSL, and zlib open source packages. The software, which IBM first unveiled in 2005, was ported to IBM i using the PASE AIX runtime environment. But this software is not affected by Heartbleed because the OpenSSL product used in the 5733-SC1 LPO package is based on OpenSSL version 0.98. Only OpenSSL version 1.0.1 through 1.0.1f are affected by Heartbleed. IBMer Ryan Watkins, who mans the IBM i OpenSSH and OpenSSL community at IBM’s developerWorks website, posted some comments about the Heartbleed vulnerability; you can view the comments here. IBM also published a webpage that says Notes/Domino is not affected, and published a similar one for WebSphere and the IBM HTTP Server running on all supported OSes, including IBM i, z/OS, AIX, Windows, Solaris, HP-UX, and Linux. That leaves us the unexpected news. While the Heartbleed vulnerability doesn’t impact the IBM i utilities package because it is running an older version of OpenSSL, other recently discovered OpenSSL vulnerabilities do impact IBM i. According to Watkins, IBM is currently working on a patch for CVE-2014-0076, or the “FLUSH+RELOAD Cache Side-channel Attack,” which was disclosed March 25. You will want to keep an eye out for the PTF when it’s ready. In the last week, IBM has patched several other recently disclosed OpenSSL vulnerabilities that do impact the IBM i utility. CVE-2013-0169, or the “Lucky Thirteen” flaw, was addressed by IBM with PTFs SI49896, SI49904, and SI49867. CVE-2013-0166, a signature verification flaw, was addressed with SI49896, SI49904, and SI49867. To view PTF cover sheets and other related information on security patches for IBM i, go to the Preventive Service Planning webpage. You will probably want to apply these patches pronto. You will also want to make sure your other IBM products (WebSphere, Apache Web server, Notes/Domino) aren’t impacted as well. Several other recently disclosed OpenSSL vulnerabilities that don’t impact the IBM i OpenSSL utility package include CVE-2013-4353, CVE-2013-6450, CVE-2013-6449, and CVE-2012-2686. IBM isn’t the only software vendor to use OpenSSL, of course, and there are several IBM i products that may also be affected by the Heartbleed flaw, but they don’t appear to be in widespread use. This includes a client for a Subversion change management system from the Russian software company Banking Technologies and Consulting, and the old firewall from Stonesoft (now part of McAfee. There are undoubtedly others. Townsend Security does use OpenSSL in its Alliance Key Manager solution, but it doesn’t use a version that is affected by Heartbleed, CEO Patrick Townsend tells IT Jungle. “Townsend Security does NOT use OpenSSL in any of our IBM i products,” Townsend says. The company’s complete statement on the Heartbleed vulnerability can be read here. Similarly, Linoma Software, which provides encryption and MFT software for IBM i, also doesn’t use OpenSSL. Instead it relies on the JSSE implementation of SSL/TLS for encrypted sessions. You can read Linoma’s take on the matter here. Now’s the fun part: Time to go change all your passwords! If you have any questions about which websites are particularly susceptible, check out the free Heartbleed vulnerability test website, www.ssllabs.com, which was set up by Qualys.
|
