HPSBGN03164 rev.2 - HP IceWall SSO Dfw, SSO Certd, MCRP, and Federation Agent running OpenSSL, Remote Disclosure of Information

Document ID:KM02993415
Creation Date:19-Oct-2017
Modified Date:19-Oct-2017

Summary

A potential security vulnerability has been identified with HP IceWall SSO Dfw , SSO Certd, MCRP, and Federation Agent runningOpenSSL. This is the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "Poodle", which could be exploited remotely resulting in disclosure of information..

Reference

		SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: KM02993415 (c04496538)

Version: 2

		HPSBGN03164 rev.2 - HP IceWall SSO Dfw, SSO Certd, MCRP, and Federation Agent running OpenSSL, Remote Disclosure of Information

		NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.

Release Date: 2014-11-10

Last Updated: 2015-03-26

Potential Security Impact: Remote disclosure of information

Source: Hewlett-Packard Company, HP Software Security Response Team

VULNERABILITY SUMMARY

A potential security vulnerability has been identified with HP IceWall SSO Dfw , SSO Certd, MCRP, and Federation Agent runningOpenSSL.

This is the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "Poodle", which could be exploited remotely resulting in disclosure of information..

References: CVE-2014-3566 (SSRT101789)

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.

		
				HP IceWall MCRP version 2.1 and 3.0

				HP IceWall SSO Dfw version 8.0, 8.0 R1, 8.0 R2, 8.0 R3, and 10.0

				HP IceWall SSO Certd version 8.0R3 with DB plugin patch 2 and 10.0

				HP IceWall Federation Agent version 3.0

BACKGROUND

For a PGP signed version of this security bulletin please write to: security-alert@hp.com

		CVSS 2.0 Base Metrics
		
							Reference

							Base Vector

							Base Score

							CVE-2014-3566

							(AV:N/AC:M/Au:N/C:P/I:N/A:N)

							4.3

		Information on CVSS is documented in HP Customer Notice: HPSN-2008-002

Reference	Base Vector	Base Score
CVE-2014-3566	(AV:N/AC:M/Au:N/C:P/I:N/A:N)	4.3

RESOLUTION

HP recommends the following software updates and workaround instructions to resolve this vulnerability for HP IceWall Federation Agent.

			Patches should be installed for both the RHEL OS and IceWall Federation Agent:
			Apply the latest RHEL security patches for OpenSSL from the following locations as appropriate:

						RHEL5: https://rhn.redhat.com/errata/RHSA-2014-1653.html 
RHEL6: https://rhn.redhat.com/errata/RHSA-2014-1652.html 

Apply HP IceWall Federation Agent version 3.0 patch release 3 from the following location:
http://www.hp.com/jp/icewall_patchaccess

Workaround Instructions for HP IceWall Federation Agent:

				If possible, use "bindings:HTTP-POST" instead of "bindings:HTTP-Artifact"setting in the service provider meta file. The "bindings:HTTP-POST"setting would prevent IWFA from using SSL for communicating with IdP server.
If it is not possible to use "bindings:HTTP-POST" in the service provider meta file, and SSL between IWFA and IdP servers cannot be disabled, then there are no workarounds. Apply the latest OpenSSL security patch from RedHat, and then apply IceWall Federation Agent 3.0 patch release 3.

HP recommends the following software updates and workaround instructions to resolve this vulnerability for HP IceWall SSO Dfw , SSO Certd, and MCRP.

The software updates are available at:

http://www.hp.com/jp/icewall_patchaccess

			Notes:
			
					There are no updates or mitigations for MCRP 2.1 and Dfw 8.0/8.0R1/8.0R2/8.0R3.

					HP recommends updating these older versions to the latest versions and patches and then following the Workaround Instructions below.

					The Workaround Instructions below should be followed after applying the following updates.

			
								Software Update Versions

								HP IceWall MCRP 3.0 Patch release 1

								HP IceWall SSO Dfw 10.0 Patch release 7

Software Update Versions
HP IceWall MCRP 3.0 Patch release 1
HP IceWall SSO Dfw 10.0 Patch release 7

Note: Both software update versions provide the use of TLSv1 which is not vulnerable and available for each supported platform.

Workaround Instructions for HP IceWall SSO Dfw , SSO Certd, and MCRP:

HP recommends the following information to protect against potential risk for the following HP IceWall products.

HP IceWall SSO Dfw and MCRP

						If possible, do not use the SHOST setting which allows IceWall SSO Dfw or MCRP to use SSL/TLS protocol to back-end web servers.

									The following steps should be applied if SSL/TLS protocol to back-end web servers must be used:
									
											For MCRP: apply MCRP patch release 1

											For Dfw: apply Dfw patch release 7 or later

											Set SSL_PROTOCOL parameter to TLSv1

HP IceWall SSO Certd

						For Certd version 10.0 and 8.0R3: apply DB plugin patch release 2
If possible, do not use the LDAPSSL setting which allows IceWall SSO Certd to connect to the LDAP server using SSL/TLS protocol.
If SSL/TLS protocol must be used to LDAP server, configure the LDAP server to use only TLSv1 as a mitigation for the vulnerability. For example, on an OpenLDAP server (slapd), Set theTLSProtocolMin parameter.

					

Note:The HP IceWall product is only available in Japan.

HISTORY
Version:1 (rev.1) - 10 November 2014 Initial release
Version:2 (rev.2) - 26 March 2015 Added HP Icewall Federation Agent to impacted products with additional patch and workaround instructions

Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.

Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com.

Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com

Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email:http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins

Security Bulletin Archive: A list of recently released Security Bulletins is available here:https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive

Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.

3C = 3COM
3P = 3rd Party Software
GN = HP General Software
HF = HP Hardware and Firmware
MP = MPE/iX
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PI = Printing and Imaging
PV = ProCurve
ST = Storage Software
TU = Tru64 UNIX
UX = HP-UX

		©Copyright 2015 Hewlett-Packard Development Company, L.P.

		Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.