Security Bulletin: A vulnerability has been addressed in the GSKit component of IBM Tivoli Network Manager IP Edition (CVE-2016-2183).

Summary

A vulnerability has been addressed in the GSKit component of IBM Tivoli Network Manager IP Edition.

Vulnerability Details

CVEID: CVE-2016-2183**
DESCRIPTION:** OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a man-in-the-middle attack could exploit this vulnerability to recover the plaintext data and obtain sensitive information. This vulnerability is known as the SWEET32 Birthday attack.
CVSS Base Score: 3.7
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/116337 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

IBM Tivoli Network Manager 3.9, 4.1.1 and 4.2

Remediation/Fixes

Product

| VRMF|APAR|Remediation/First Fix
—|—|—|—
IBM Tivoli Network Manager IP Edition| 3.9.0.5| IV95396| <http://www-01.ibm.com/support/docview.wss?uid=swg24043618&gt;
IBM Tivoli Network Manager IP Edition| 4.1.1.2 | IV95396| <http://www-01.ibm.com/support/docview.wss?uid=swg24041066&gt;
IBM Tivoli Network Manager IP Edition| 4.2.0.3| IV95396| <http://www-01.ibm.com/support/docview.wss?uid=swg24043575&gt;

Workarounds and Mitigations

None