IBM Tealeaf Vulnerability Advisory: CVE-2016-2177/2178/5385/5900

Vulnerability Key Information Overview Disclosure Date: September 22 and 26, 2016 Affected Product: IBM Tealeaf Customer Experience on Cloud Network Capture Add-On Vulnerability Details CVE-2016-2177 Description: Denial of service vulnerability in OpenSSL due to improper use of pointer arithmetic. CVSS Base Score: 5.9 CVE-2016-2178 Description: OpenSSL vulnerability in DSA implementation that could allow remote attackers to recover private keys via cache timing attacks. CVSS Base Score: 5.3 CVE-2016-5385 Description: PHP vulnerability where CGI applications are not protected against untrusted client data in the HTTP_PROXY environment variable, potentially leading to HTTP traffic redirection. CVSS Base Score: 8.1 CVE-2016-5900 Description: IBM Tealeaf Customer Experience on Cloud Network Capture Add-On vulnerability due to failed TLS certificate validation, potentially leading to sensitive information disclosure. CVSS Base Score: 5.9 Affected Products and Versions Version: IBM Tealeaf Customer Experience on Cloud Network Capture Add-On 16.1.01 Remediation and Workarounds Remediation: Patch available via download link. Workarounds: Restrict access to the local network containing Tealeaf servers to prevent unauthorized access or disruption of Tealeaf services; limit access to PCA systems as much as possible.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Tealeaf Vulnerability Advisory: CVE-2016-2177/2178/5385/5900