Systemwalker Service Quality Coordinator: Vulnerability in processing of ChangeCipherSpec messages in OpenSSL(CVE-2014-0224). August 7th, 2014

Notes on using this web page

1. Description

In the case of the following functions and conditions of Systemwalker Service Quality Coordinator, a vulnerability problem exists in handling the messages of Change Cipher Spec in OpenSSL.

• Agentless Monitoring (All kinds of OS, V13.5.0 or later)
  • In the case the monitored server is VMware ESX, VMware ESXi, or VMware vCenter, and
  • In the case "HTTPS" is set as the communication method for communicating with monitored server, and
  • In the case a monitored server is using the OpenSSL corresponding to this vulnerability.
• Service Operation Management (All kinds of OS, all versions)
  • In the case "HTTPS" service is manged, and
  • In the case the managed service is using the OpenSSL corresponding to this vulnerability.
• End User Response Management (Browser Agent) (OS: Windows, all versions)
  • In the case a collection server is using "HTTPS" service, and
  • In the case the collection server is using the OpenSSL corresponding to this vulnerability.

The workaround shown in 3-3. are provided, and Fujitsu requests that these be applied promptly.

2. Impact

The communication data of Systemwalker Service Quality Coordinator can be decoded or falsified by man-in-the-middle attack.

Please refer to the public information of JVN described in "4. Related information" for the severity of this vulnerability.

3. Affected systems and corresponding action

3-1. Affected systems:

PRIMERGY, GP5000, PRIMEPOWER, GP7000F, SPARC, PRIMEQUEST, CELSIUS, FMV

3-2. Affected products and required patch

For the solution, please refer to the following "3-3. Workaround".

Note: Determining the affected product

How to confirm the version level of the product which you are using is as below.
Note that Uninstallation and Management (middleware) can be confirmed when the version level of Systemwalker Service Quality Coordinator is V15.0.0 or later.

How to confirm the version level of the product:

If the server is Windows:

• From the Start menu, select All Programs or All Applications, Fujitsu, Uninstallation and Management(middleware).
• Confirm the version level of Systemwalker Service Quality Coordinator.

Or,

• Double-click Add/Remove Programs or Add or Remove Programs in Control Panel.
• Confirm the version level of Systemwalker Service Quality Coordinator.

If the server is Linux:

• Confirm the version level by Uninstallation and Management(middleware).
  Run the following command from the Console.
    # /opt/FJSVcir/cir/bin/cimanager.sh -c

Or,

• Run the following command from the Console.
  The package name can be confirmed in Release Note.
    # rpm -iq package-name
  Example: When you confirm the version level of Manager:
    # rpm -iq FJSVsqcmg

If the server is Solaris:

• Confirm the version level by Uninstallation and Management(middleware).
  Run the following command from the Console.
    # /opt/FJSVcir/cir/bin/cimanager.sh -c

Or,

• Run the following command from the Console.
  The package name can be confirmed in Release Note.
    # pkginfo -l package-name
  Example: When you confirm the version level of Manager:
     # pkginfo -l FJSVsqcmg

3-3. Workaround

• In case of I. Agentless Monitoring described in 1. Description
  Agentless Monitoring: Apply patches for the VMware which is monitored server.
  Regarding patches of VMware, please refer to the public information described in 4. Related information.
• In case of II. Service Operation Management and III. End User Response Management (Browser Agent) described in 1. Description
  Change the version of the following OpenSSL to 1.0.1h or later.
  • Service Operation Management: The OpenSSL which the managed service uses
  • End User Response Management (Browser Agent): The OpenSSL which the collection server uses

4. Related information

• National Vulnerability Database (NVD): CVE-2014-0224
  http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0224
• VMware
  • http://kb.vmware.com/selfservice/microsites/search.do?cmd=displayKC&docType=kc&externalId=2079783&sliceId=1&docTypeID=DT_KB_1_1&dialogID=282054392&stateId=1%200%20282062537
  • http://www.vmware.com/security/advisories/VMSA-2014-0006.html

5. Revision history

• August 7th, 2014: 5th release
  • "3-2. Affected products and required patch": Added Patch IDs.
• July 24th, 2014: 4th release
  • "3-2. Affected products and required patch": Added Patch IDs.
• July 11th, 2014: 3rd release
  • "3-2. Affected products and required patch": Updated some patch schedules.
• June 23rd, 2014: 2nd release
  • "1. Description" and "3-3. Workaround": Corrected the words "Browser Agent" to "End User Response Management (Browser Agent)".
  • "4. Related information": Added related information of the VMware.
• June 13th, 2014: Initial release