✕
Request a Demo
Rewterz
Rewterz Threat Advisory – The SeedWorm APT targeting more than 30 organizations across continents
December 12, 2018
Rewterz
Rewterz Threat Advisory – Microsoft Edge Memory Corruption Multiple Vulnerabilities
December 13, 2018

Rewterz Threat Advisory – CVE-2018-0732 – IBM Lotus Protector for Mail Security OpenSSL Denial of Service Vulnerability

A vulnerability has been reported in IBM Lotus Protector for Mail Security, which can be exploited by malicious people to cause a DoS (Denial of Service).  

 

 

IMPACT:  NORMAL

 

 

PUBLISH DATE:  13-DEC-2018

 

 

OVERVIEW

 

 

A malicious server can send a very long prime value to a client. The client will have to spend a long time generating a key for this prime value. This may cause a hang and lead to Denial of Service.

 

 

ANALYSIS

 

 

OpenSSL is vulnerable to a Denial of Service (DoS) vulnerability. During key agreement in a TLS handshake using a DH(E) based ciphersuite, a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished.

 

This could be exploited in a Denial of Service attack.

Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h).

Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).

 

 

AFFECTED PRODUCTS

 

 

  • IBM Lotus Protector for Mail Security 2.8.3.0
  • IBM Lotus Protector for Mail Security 2.8.1.0

 

 

UPDATES

 

 

This is done via the IBM Protector for Mail Security update mechanism. Follow the link for downloading updates for IBM Lotus Protector for mail security.

 

   https://www-01.ibm.com/support/docview.wss?uid=ibm10743847

 

If you think you’re the victim of a cyber-attack, immediately send an email to soc@rewterz.com for a quick response.