Security Bulletin: IBM Sterling Connect:Express for UNIX is affected by multiple vulnerabilities in OpenSSL

Summary

A number of security vulnerabilities have been discovered in the OpenSSL libraries included in IBM Sterling Connect:Express for UNIX.

Vulnerability Details

CVE ID: CVE-2013-0169 CVE-2013-0166 CVE-2012-2686 CVE-2012-2131 CVE-2012-2110 CVE-2012-0884 CVE-2012-0050 CVE-2011-4108 CVE-2011-4576 CVE-2011-4577 CVE-2011-4619 CVE-2012-0027 CVE-2011-3207 CVE-2011-3210 CVE-2011-0014 CVE-2010-4252 CVE-2010-3864 CVE-2010-0742 CVE-2010-1633

DESCRIPTION: IBM Sterling Connect:Express for UNIX uses OpenSSL libraries for cryptography and a number of security vulnerabilities have been discovered in the OpenSSL libraries.

Affected Products and Versions

IBM Sterling Connect:Express for UNIX 1.4.6.

IBM Sterling Connect:Express for UNIX 1.5.0.

Remediation/Fixes

The recommended solution is to apply the fix for each version as soon as practical. See below for information on the available fixes.

• Version 1.5.0: apply Fix Pack 1.5.08
• Version 1.4.6: apply Fix Pack 1.4.64

Workarounds and Mitigations

None known. Apply fix.