Security Bulletin: Multiple vulnerabilities in IBM® Java SDK have been identified in IBM WebSphere Application Server shipped with IBM Integrated Information Core (January 2017 CPU)

Summary IBM WebSphere Application Server is shipped as a component of IBM Integrated Information Core. Oracle released the January 2017 critical patch updates that contain multiple fixes for security vulnerabilities in the IBM Java Development Kit that is included with IBM WebSphere Application...

Security Bulletin: A vulnerability has been addressed in the GSKit component of IBM Tivoli Network Manager IP Edition (CVE-2016-2183).

Summary A vulnerability has been addressed in the GSKit component of IBM Tivoli Network Manager IP Edition. Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of t...

Security Bulletin: GSKit Sweet32 Birthday attacks on 64-bit block ciphers in TLS affects the Tivoli Storage Manager (IBM Spectrum Protect) Server (CVE-2016-2183)

Summary GSKit is vulnerable to Sweet32 Birthday attacks on 64-bit block ciphers in TLS which affects the Tivoli Storage Manager IBM Spectrum Protect Server. Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: An error in the DES/3DES cipher, used as a part of the SSL/TLS protocol, could allow...

Security Bulletin: IBM Tivoli Monitoring Basic Services component. (CVE-2016-2183)

Summary Vulnerability in GSKit component of IBM Tivoli Monitoring has been addressed. Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. B...

Security Bulletin: Vulnerability in the GSKit component of Tivoli Netcool/OMNIbus (CVE-2016-2183)

Summary Vulnerability has been addressed in the GSKit component of Tivoli Netcool/OMNIbus. Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS...

Security Bulletin: A vulnerability in the GSKIT component of the Core Framework affects IBM Performance Management products (CVE-2016-2183)

Summary OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a...

Security Bulletin: Multiple vulnerabilites in IBM Java Runtime affect Tivoli Storage Manager (IBM Spectrum Protect) for Virtual Environments: Data Protection for VMware and FlashCopy Manager (IBM Spectrum Protect Snapshot) for VMware

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ used by Tivoli Storage Manager for Virtual Environments IBM Spectrum Protect for Virtual Environments: Data Protection for VMware and FlashCopy Manager IBM Spectrum Protect Snapshot for VMware. These issues were disclose...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect ITCAM for SOA (CVE-2016-5597, CVE-2016-5546, CVE-2016-5548, CVE-2016-5549, CVE-2016-5547, CVE-2016-2183)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 6 used by Tivoli Composite Application Manager for SOA. These issues were disclosed as part of the IBM Java SDK updates in October 2016 and Jan 2017. Vulnerability Details CVEID: CVE-2016-5597 DESCRIPTION: An...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM Operations Analytics Predictive Insights (CVE-2016-5546, CVE-2016-5548, CVE-2016-5549, CVE-2016-5547, CVE-2016-2183)

Summary Vulnerability in IBM® SDK Java™ Technology Edition, Version 7 Service Refresh 9 Fix Pack 60 that is used by IBM Operations Analytics Predictive Insights 1.3.5. This issue was disclosed as part of the IBM Java SDK updates in January 2017. Vulnerability Details CVEID: CVE-2016-5546...

Security Bulletin: IBM MessageSight affected by GSKit Sweet32 Birthday attacks (CVE-2016-2183)

Summary IBM MessageSight is affected by a GSKit vulnerability in the MQClient. Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By...

Security Bulletin: Multiple vulnerabilities affect Watson Explorer Content Analytics Studio (CVE-2016-5546 CVE-2016-5548 CVE-2016-5549 CVE-2016-5547 CVE-2016-2183)

Summary Security vulnerabilities have been identified in IBM® Runtime Environment Java™ Technology Edition that is used by Watson Explorer Content Analytics Studio. Vulnerability Details CVEID: CVE-2016-5546 DESCRIPTION: An unspecified vulnerability in Oracle Java SE Java SE Embedded and Jrockit...

Security Bulletin: Multiple vulnerabilities affect Watson Explorer and Watson Content Analytics (CVE-2016-5546, CVE-2016-5548, CVE-2016-5549, CVE-2017-3252, CVE-2016-5547, CVE-2016-2183)

Summary Security vulnerabilities have been identified in IBM® Runtime Environment Java™ Technology Edition that is used by Watson Explorer and Watson Content Analytics. Vulnerability Details CVEID: CVE-2016-5546 DESCRIPTION: An unspecified vulnerability in Oracle Java SE Java SE Embedded and...

Security Bulletin: GSKit Sweet32: Birthday attacks in IBM Content Collector for Microsoft SharePoint

Summary OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a...

Security Bulletin: GSKit Sweet32: Birthday attacks in Content Collector for IBM Connections

Summary OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a...

Security Bulletin: GSKit Sweet32: Birthday attacks in IBM Content Collector for File Systems

Summary OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a...

Security Bulletin: GSKit Sweet32: Birthday attacks in IBM Content Collector for Email

Summary OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a...

Security Bulletin: Sweet32 Birthday attacks on 64-bit block ciphers in TLS affect Content Manager for z/OS (CVE-2016-2183)

Summary System SSL's SSL V2, SSL V3 and TLS protocols support the use of Triple DES ciphers and are susceptible to the Sweet32 Birthday attack vulnerability. This vulnerability affects exploiters acting as either clients or servers. Content Manager 8 Resource Manager on z/OS uses System SSL and...

Security Bulletin: OpenSSL and OpenVPN vulnerabilities affect IBM Rational Team Concert (CVE-2016-2183, CVE-2016-6329)

Summary OpenSSL and OpenVPN vulnerabilities affect IBM Rational Team Concert. OpenSSL and OpenVPN are used by Rational BuildForge Agent shipped with IBM Rational Team Concert. Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Security Directory Integrator CVE-2016-5546 (CVSS 7.5) , CVE-2016-5548 (CVSS 6.5), CVE-2016-5549 (CVSS 6.5), CVE-2016-5547 (CVSS 5.3), CVE-2016-2183 (CVSS 3.1)

Summary There are multiple vulnerabilities in IBM Runtime Environment Java Technology Edition Version 6.0 and Version 7.0 that is used by Security Directory Integrator. These issues were disclosed as part of the IBM Java SDK updates in January 2017. Vulnerability Details CVEID: CVE-2016-5546...

Security Bulletin: IBM Tivoli Access Manager for e-business and IBM Security Access Manager for Web software releases are affected by a vulnerability known as the SWEET32 Birthday attack (CVE-2016-2183)

Summary The IBM Tivoli Access Manager for e-business and IBM Security Access Manager for Web software releases are affected by the SWEET32 Birthday attack vulnerability, which could allow an attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: OpenSSL...