Security Bulletin: GSKit Sweet32 Birthday attacks on 64-bit block ciphers in TLS affects the Tivoli Storage Manager (IBM Spectrum Protect) Server (CVE-2016-2183)

Summary

GSKit is vulnerable to Sweet32 Birthday attacks on 64-bit block ciphers in TLS which affects the Tivoli Storage Manager (IBM Spectrum Protect) Server.

Vulnerability Details

CVEID: CVE-2016-2183**
DESCRIPTION:** An error in the DES/3DES cipher, used as a part of the SSL/TLS protocol, could allow a remote attacker to obtain sensitive information. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a man-in-the-middle attack could exploit this vulnerability to recover the plaintext data and obtain sensitive information. This vulnerability is known as the SWEET32 Birthday attack.
CVSS Base Score: 3.7
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/116337 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

This vulnerability affects the following IBM Tivoli Storage Manager (IBM Spectrum Protect) Server levels:

• All 8.1 levels below 8.1.1
• 7.1.0.0 through 7.1.7.0
• 6.3.0.0 through 6.3.6.0
• 6.2, 6.1, and 5.5 all levels (these releases are EOS)

Remediation/Fixes

Tivoli Storage Manager Server Release

| Fixing
VRM
Level|**_

Platform_|Link to Fix / Fix Availability Target**
—|—|—|—
8.1| 8.1.1.000| AIX
Linux
Window| https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=IBM%20Spectrum%20Protect%20family&product=ibm/StorageSoftware/IBM+Spectrum+Protect&release=8.1.0&platform=All&function=all
7.1| 7.1.7.100| AIX
HP-UX
Linux
Solaris
Windows| https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~Tivoli&product=ibm/Tivoli/Tivoli+Storage+Manager&release=7.1.7.100&platform=All&function=all_
_
6.3| 6.3.6.100| AIX
HP-UX
Linux
Solaris
Windows| https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~Tivoli&product=ibm/Tivoli/Tivoli+Storage+Manager&release=6.3.6.100&platform=All&function=all_
_
6.2 and below|
|
| Customers on these releases can upgrade the server to a fixed level (8.1.1.000, 7.1.7.100 or 6.3.6.100). Contact IBM Support if you have any questions.

Workarounds and Mitigations

None