How to remediate – AIX OpenSSL Advisory : openssl_advisory30.asc

1. Introduction

The AIX OpenSSL Advisory : openssl_advisory30.asc details a vulnerability affecting versions of OpenSSL installed on AIX systems. This is a side channel attack information disclosure issue that could allow a local attacker to gain sensitive information. Confidentiality may be impacted if an attacker can successfully exploit this vulnerability.

2. Technical Explanation

The affected version of OpenSSL contains a flaw where a side-channel attack can reveal information about the data being processed during cryptographic operations. An attacker with local access could potentially use timing variations to deduce sensitive data. This is tracked as CVE-2019-1559. For example, an attacker on a system running a vulnerable version of OpenSSL could attempt to decrypt network traffic and infer parts of the encryption key by measuring the time it takes to perform certain operations.

• Root cause: The vulnerability is due to timing differences in cryptographic operations based on input data.
• Exploit mechanism: An attacker measures the execution time of OpenSSL functions with varying inputs to infer information about the key or plaintext.
• Scope: AIX systems running vulnerable versions of OpenSSL are affected.

3. Detection and Assessment

You can confirm if your system is vulnerable by checking the installed OpenSSL version. A thorough method involves reviewing security advisories from IBM.

• Quick checks: Use the following command to check the OpenSSL version: openssl version
• Scanning: Nessus plugin ID 128649 can detect this vulnerability, but results should be verified.
• Logs and evidence: There are no specific log files or event IDs directly indicative of exploitation; focus on identifying vulnerable versions.

openssl version

4. Solution / Remediation Steps

Apply the fix available from IBM AIX website to address this vulnerability. Follow these steps carefully.

4.1 Preparation

• A change window may be required depending on your organization’s policies; approval from system owners might be necessary.

4.2 Implementation

1. Step 1: Download the appropriate fix package for your AIX version from https://aix.software.ibm.com/aix/efixes/security/openssl_advisory30.asc.
2. Step 2: Install the fix package using the smitty apply command or equivalent method for your AIX version.
3. Step 3: Reboot the system if prompted by the installation process.

4.3 Config or Code Example

There is no specific configuration change required; this vulnerability is addressed through patching OpenSSL.

Before

N/A - Vulnerable OpenSSL version installed

After

N/A - Patched OpenSSL version installed

4.4 Security Practices Relevant to This Vulnerability

Regular patch management is crucial for mitigating this type of vulnerability. Least privilege can also limit the impact if an attacker gains access.

• Practice 1: Implement a regular patch cadence to ensure timely application of security updates.
• Practice 2: Enforce least privilege principles to restrict user access and minimize potential damage from exploitation.

4.5 Automation (Optional)

Automation is not generally suitable for this specific vulnerability due to the need for system reboots and careful package management.

N/A - Not applicable

5. Verification / Validation

Confirm that the patch has been applied successfully by checking the OpenSSL version again. Perform a smoke test of key services to ensure functionality remains intact.

• Post-fix check: Run openssl version and verify the output shows an updated, patched version of OpenSSL.
• Re-test: Re-run openssl version to confirm the vulnerability is no longer present.
• Smoke test: Verify that SSL/TLS connections to key services (e.g., web servers, email servers) are still functioning correctly.

openssl version

6. Preventive Measures and Monitoring

Update your security baselines to include the patched OpenSSL version. Consider adding checks in your CI/CD pipeline to verify that systems are running supported versions of OpenSSL.

• Baselines: Update your AIX security baseline or policy to require the latest OpenSSL patch.
• Asset and patch process: Review and update your asset inventory and patch management processes to include OpenSSL as a critical component.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: System reboot may interrupt services; plan accordingly.

8. References and Resources

Refer to official IBM documentation for details on this vulnerability and the available fix.

• Vendor advisory or bulletin: https://aix.software.ibm.com/aix/efixes/security/openssl_advisory30.asc
• NVD or CVE entry: CVE-2019-1559