CVE-2014-6176
First published: Tue Dec 16 2014(Updated: )
IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 disregard the SSL setting in the SCA module HTTP import binding and unconditionally select the SSLv3 protocol, which makes it easier for remote attackers to hijack sessions or obtain sensitive information by leveraging the use of a weak cipher.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Business Process Manager | =7.5.0.0 | |
| IBM Business Process Manager | =7.5.0.1 | |
| IBM Business Process Manager | =7.5.1.0 | |
| IBM Business Process Manager | =7.5.1.1 | |
| IBM Business Process Manager | =8.0.0.0 | |
| IBM Business Process Manager | =8.0.1.0 | |
| IBM Business Process Manager | =8.0.1.1 | |
| IBM Business Process Manager | =8.0.1.2 | |
| IBM Business Process Manager | =8.0.1.3 | |
| IBM Business Process Manager | =8.5.0.0 | |
| IBM Business Process Manager | =8.5.0.1 | |
| IBM Business Process Manager | =8.5.5.0 | |
| Ibm Websphere Enterprise Service Bus | =7.0 | |
| IBM WebSphere Process Server | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-6176?
CVE-2014-6176 has a high severity rating due to the use of the SSLv3 protocol which is vulnerable to attacks.
How do I fix CVE-2014-6176?
To fix CVE-2014-6176, you should configure your server to disable SSLv3 and enforce the use of more secure protocols.
What software versions are affected by CVE-2014-6176?
CVE-2014-6176 affects IBM Business Process Manager versions 7.5.x to 8.5.x, as well as IBM WebSphere Process Server 7.0 and WebSphere Enterprise Service Bus 7.0.
What issues can arise from CVE-2014-6176?
CVE-2014-6176 can lead to potential man-in-the-middle attacks due to the vulnerabilities associated with SSLv3.
Is there a workaround for CVE-2014-6176?
A possible workaround for CVE-2014-6176 includes setting up additional security measures such as stronger encryption protocols until a patch is finalized.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/references
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- vendor/ibm
- canonical/ibm business process manager
- version/ibm business process manager/7.5.0.0
- version/ibm business process manager/7.5.0.1
- version/ibm business process manager/7.5.1.0
- version/ibm business process manager/7.5.1.1
- version/ibm business process manager/8.0.0.0
- version/ibm business process manager/8.0.1.0
- version/ibm business process manager/8.0.1.1
- version/ibm business process manager/8.0.1.2
- version/ibm business process manager/8.0.1.3
- version/ibm business process manager/8.5.0.0
- version/ibm business process manager/8.5.0.1
- version/ibm business process manager/8.5.5.0
- canonical/ibm websphere enterprise service bus
- version/ibm websphere enterprise service bus/7.0
- canonical/ibm websphere process server
- version/ibm websphere process server/7.0