Security Bulletin: IBM InfoSphere Information Server and IBM InfoSphere Data Click are affected by the following OpenSSL vulnerability (CVE-2014-0224)

Summary

Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project.

Vulnerability Details

CVE ID:CVE-2014-0224 ** ** **DESCRIPTION: **OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients and servers. A remote attacker could exploit this vulnerability using a specially-crafted handshake to conduct man-in-the-middle attacks to decrypt and modify traffic.

CVSS Base Score: 5.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/93586 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N)

Affected Products and Versions

-- IBM InfoSphere Information Server versions 8.0, 8.1, 8.5, 8.7, 9.1 and 11.3 running on all platforms.
-- IBM InfoSphere Data Click version 10.0 running on Linux

Remediation/Fixes

Product

| VRMF|APAR|Remediation/First Fix
—|—|—|—
InfoSphere Information Server| 11.3| JR50611| --Upgrade to DataDirect ODBC drivers version 7.1.4
--Follow the driver post installation steps in TechNote
InfoSphere Data Click| 10.0| JR50611| Contact IBM customer support to obtain the fix.
InfoSphere Information Server| 9.1| JR50611| --Upgrade to DataDirect ODBC drivers version 7.1.4
--Follow the driver post installation steps in TechNote
InfoSphere Information Server| 8.7| JR47635
JR42587
JR50611| --Apply IBM InfoSphere Information Server version 8.7 Fix Pack 2
--Upgrade to DataDirect ODBC drivers version 7.1.4
--Follow the driver post installation steps in TechNote
InfoSphere Information Server| 8.5| JR47635
JR42587
JR50611| --Apply IBM InfoSphere Information Server version 8.5 Fix Pack 3
--Upgrade to DataDirect ODBC drivers version 7.1.4
--Follow the driver post installation steps in TechNote
InfoSphere Information Server| 8.1| JR47635
JR42587
JR50611| --Apply IBM InfoSphere Information Server version 8.1 Fix Pack 2
--Apply the ODBC Enterprise stage Patch
--Apply the ODBC Connector Patch
--Upgrade to DataDirect ODBC drivers version 7.1.4
--Follow the driver post installation steps in TechNote
InfoSphere Information Server| 8.0| JR50611| Contact IBM customer support.

Workarounds and Mitigations

None known