How to remediate – AIX OpenSSL Advisory : openssl_advisory3.asc

1. Introduction

The AIX OpenSSL Advisory : openssl_advisory3.asc details several vulnerabilities in older versions of OpenSSL running on AIX systems. These flaws could allow remote attackers to obtain sensitive information, cause a denial of service, or execute arbitrary code. Systems commonly affected include servers and applications relying on OpenSSL for secure communications. A successful exploit may compromise confidentiality, integrity, and availability of the system.

2. Technical Explanation

The vulnerabilities stem from flaws in the handling of DTLS implementations, double-free issues when policy checks are enabled, improper SSL 3.0 initialization, incorrect Server Gated Cryptography (SGC) handling, and a fix error for CVE-2011-4108. An attacker could exploit these weaknesses by sending crafted network packets to trigger padding oracle attacks, policy check failures, or handshake issues. These vulnerabilities require the target system to be running an affected version of OpenSSL and allow remote connections.

• Exploit mechanism: An attacker can send malicious network traffic to exploit the vulnerabilities in OpenSSL, potentially leading to information disclosure or denial of service. For example, a crafted DTLS packet could trigger the padding oracle vulnerability (CVE-2011-4108).

3. Detection and Assessment

To confirm vulnerability, check the installed OpenSSL version. A thorough method involves reviewing system logs for evidence of exploitation attempts.

• Quick checks: Use the following command to determine the OpenSSL version: openssl version
• Logs and evidence: Check system logs for unusual SSL/TLS activity or errors related to OpenSSL. Specific log files vary depending on the AIX configuration.

openssl version

4. Solution / Remediation Steps

4.1 Preparation

• Create a mksysb backup of the system and verify it is bootable and readable. Stop any services that rely on OpenSSL if possible.
• The fix package can be downloaded from IBM’s AIX website. A roll back plan involves restoring the mksysb backup if issues occur.

4.2 Implementation

1. Step 1: Extract the fix package using one of the following commands: zcat openssl.0.9.8.1801.tar.Z | tar xvf - or zcat openssl-fips.12.9.8.1801.tar.Z | tar xvf - or zcat openssl.0.9.8.809.tar.Z | tar xvf -
2. Step 2: Preview the fix installation using: installp -apYd . openssl
3. Step 3: Install the fix package with: installp -aXYd . openssl

4.3 Config or Code Example

No configuration changes are required; this is a patch installation.

Before

N/A - This is a patch, not a config change. Check 'openssl version' before patching.

After

N/A - Verify the updated OpenSSL version after patching using 'openssl version'.

4.4 Security Practices Relevant to This Vulnerability

Regular patch management is crucial for addressing vulnerabilities like these. Least privilege can limit the impact of successful exploits.

• Practice 1: Implement a regular patch cadence to ensure timely application of security updates, reducing the window of opportunity for attackers.
• Practice 2: Apply least privilege principles to restrict access to sensitive resources and minimize potential damage from compromised accounts or services.

4.5 Automation (Optional)

Automation is not included as this requires careful consideration of system dependencies.

N/A - Patching should be done carefully, automation is not recommended without thorough testing.

5. Verification / Validation

• Post-fix check: Run openssl version and verify that the output shows a patched version (e.g., OpenSSL 0.9.8s or later, or 1.0.0f or later).
• Re-test: Re-run the openssl version command to confirm the updated version is installed.
• Monitoring: Monitor system logs for any new errors related to OpenSSL, which could indicate a regression or unexpected behavior.

openssl version

6. Preventive Measures and Monitoring

Update security baselines to include the patched OpenSSL versions. Implement vulnerability scanning in CI/CD pipelines.

• Baselines: Update your AIX security baseline or policy to require a minimum OpenSSL version of 0.9.8s or 1.0.0f.
• Asset and patch process: Establish a regular patch review cycle (e.g., monthly) to ensure timely application of security updates.

7. Risks, Side Effects, and Roll Back

Applying the patch may cause temporary service disruptions. The roll back plan involves restoring from the mksysb backup.

• Risk or side effect 1: Temporary service interruption during patching. Mitigate by scheduling maintenance windows.
• Roll back: Restore the system from the mksysb backup created prior to applying the patch.

8. References and Resources

• Vendor advisory or bulletin: https://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc
• NVD or CVE entry: CVE-2011-4108, CVE-2011-4109, CVE-2011-4576, CVE-2011-4619, CVE-2