Security Bulletin
Summary
A vulnerability in GSKit, which is included in IBM WebSphere MQ, can potentially allow key information about certain kinds of binary type Elliptic Curves used in Digital signatures during signing operations.
Vulnerability Details
CVE-ID: CVE-2014-0076
DESCRIPTION: An attacker running a program on the same machine as where the victim is running a program could use CPU timing information to discover key information about certain kinds of binary type Elliptic Curves used in Digital signatures during signing operations. Although GSKit only generates Prime type Elliptic Curves, externally generated keys may be imported in GSKit.
From WebSphere MQ version 7.1, GSKit version 8.0 is integrated with WebSphere MQ. For WebSphere MQ 7.0.1, GSKit version 7 or version 8 was installed separately.
CVSS Base Score: 2.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/91990
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N)
Affected Products and Versions
IBM WebSphere MQ 8.0, including all maintenance levels.
IBM WebSphere MQ 7.5, including all maintenance levels.
IBM WebSphere MQ 7.1, including all maintenance levels.
IBM WebSphere MQ 7.0.1, maintenance levels from 7.0.1.4 onwards, using GSKit version 8.0.
Remediation/Fixes
IBM strongly recommends that Elliptic Curve CipherSpecs are not used. These CipherSpecs have names starting with 'EC'.
A summary of MQ CipherSpecs and protocols can be found in the IBM Knowledge Center Specifying CipherSpecs topic.
Get Notified about Future Security Bulletins
References
Change History
03 November 2014: Original Copy Published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
15 June 2018
UID
swg21688949