Security Bulletin: IBM InfoSphere Guardium Data Encryption is affected by vulnerabilities in OpenSSL (CVE-2014-0076, CVE-2014-0160)

Abstract Security vulnerabilities have been discovered in OpenSSL. Content VULNERABILITY DETAILS: CVE-ID:CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this...

Security Bulletin: Multiple vulnerabilities in IBM JRE affect InfoSphere Data Replication Dashboard (CVE-2013-0440, CVE-2013-0443, CVE-2013-0169)

Abstract The IBM JRE embedded in the InfoSphere Data Replication Dashboard has security vulnerabilities that affect SSL connections to the dashboard web server. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-0440 DESCRIPTION: An unspecified vulnerability allows remote attackers to affect...

Security Bulletin: IBM DB2 is impacted by a vulnerability in the IBM GSKit library (CVE-2013-0169).

Abstract GSKit is used by IBM DB2 for SSL support. The version of GSKit iused by DB2 is vulnerable to the “Lucky Thirteen” security vulnerability. By default, DB2 does not use SSL for client-server communication and therefore DB2 is vulnerable only if SSL is enabled. Content VULNERABILITY DETAILS...

Security Bulletin: InfoSphere Data Replication Dashboard is affected by a vulnerability in the IBM JRE (CVE-2013-0169)

Abstract The IBM JRE that is embedded in the InfoSphere Data Replication Dashboard has a security vulnerability that affects SSL connections to the dashboard web server. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-0169 DESCRIPTION: The TLS protocol does not properly consider timing side-chann...

Security Bulletin: Multiple vulnerabilities in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite (CVE-2013-2953, CVE-2013-2954, CVE-2013-2955, CVE-2013-2956, CVE-2013-2957, CVE-2013-2959)

Abstract Multiple vulnerabilities have been identified in the Optim E-Business Console making the product vulnerable to phishing attacks, the interception of credentials and the bypass of login entirely. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-2953 DESCRIPTION: Use of MD5 as SSL Certifica...

Security Bulletin: Security Vulnerabilities fixed in IBM WebSphere Application Server 7.0.0.23

Abstract Cross reference list for security vulnerabilities fixed in WebSphere Application Server Fix Pack 7.0.0.23 Content VULNERABILITY DETAILS: CVE ID:CVE-2012-0720 PM52274 DESCRIPTION: WebSphere Application Server Administration Console is vulnerable to cross-site scripting, caused by improper...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IMS™ Enterprise Suite: Connect API for Java, SOAP Gateway, and Explorer for Development (CVE-2015-0138, CVE-2015-0410, CVE-2014-6593)

Abstract There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, IBM SDK, Java Technology Edition, Version 7 Service Refresh 8 that is used the following IMS™ Enterprise Suite components: Connect API for Java, SOAP Gateway, and Explorer for Development. These issues were disclose...

Security Bulletin: Vulnerability in RC4 stream cipher affects Operations Analytics Predictive Insights (CVE-2015-2808)

Abstract The RC4 “Bar Mitzvah” Attack for SSL/TLS affects Operations Analytics Predictive Insights which is consuming WebSphere Application Server 8.5.5.1 Content Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a...

Security Bulletin: Multiple vulnerabilities in Product IMS Enterprise Suite SOAP Gateway (CVE-2012-5785, CVE-2013-0483)

Abstract IMS™ Enterprise Suite SOAP Gateway V1.1, V2.1, and V2.2 security vulnerabilities in SSL connections and login processes. Content Security Bulletin: Multiple vulnerabilities exist in IMS Enterprise Suite SOAP Gateway CVE-2012-5785, CVE-2013-0483 SUMMARY: IMS™ Enterprise Suite SOAP Gateway...

Security Bulletin: Multiple vulnerabilities in IBM Rational Policy Tester (CVE-2013-0531, CVE-2013-0440, CVE-2013-4062, CVE-2013-4061, CVE-2013-2407)

Abstract Previous releases of IBM Rational Policy Tester are affected by multiple vulnerabilities reported in 3rd party components bundled with the product as well as in proprietary IBM code. These vulnerabilities include Java components, weak cipher suites, invalid certificate warnings and URL...

Security Bulletin: TXSeries for Multiplatforms V7.1 : Security vulnerability in using GSKit 8 version with IBM TXSeries for Multiplatforms Version 7.1 (CVE-2013-6329)

Abstract Vulnerabilities in relation to SSL/TLS Handshake Processing related to the Session Resumption when using SSLV2 of GSKit 8 with TXSeries for Multiplatforms V7.1 have been addressed Content VULNERABILITY DETAILS: CVEID: CVE-2013-6329 DESCRIPTION: A SSLV2 ClientHello that successfully resum...

Security Bulletin: IBM Sterling Connect:Direct for OpenVMS. Unencrypted data transfers can occur even when SSL encryption is specified in the security configuration. (CVE-2013-4035)

Abstract Unencrypted data transfers can occur even when SSL encryption is specified in the security configuration. Content VULNERABILITY DETAILS: CVEID: CVE-2013-4035 DESCRIPTION: When Connect:Direct for OpenVMS is the server in a TCP/IP session, and the client requests an unencrypted session, C:...

Security Bulletin: Multiple JRE vulnerabilities addressed in IBM Sterling External Authentication Server (CVE-2013-1571, CVE-2013-1500, CVE-2013-0443, CVE-2013-0440, CVE-2013-0169)

Abstract The IBM JRE embedded in the IBM Sterling External Authentication Server has security vulnerabilities in its Javadoc, and in SSL connections to the configuration GUI. Content VULNERABILITY DETAILS CVE ID: CVE-2013-1571 DESCRIPTION: The Javadoc documentation generated for the Sterling...

Security Bulletin: IBM Sterling Connect:Direct for UNIX is affected by a security vulnerability in OpenSSL (CVE-2011-4576)

Abstract A security vulnerability has been discovered in the OpenSSL libraries included in IBM Sterling Connect:Direct for UNIX that results in a security vulnerability in IBM Sterling Connect:Direct for UNIX. Content VULNERABILITY DETAILS: CVE ID : CVE-2011-4576 DESCRIPTION: IBM Sterling...

Security Bulletin: GSKit certificate chain vulnerability in IBM Security Directory Server and Tivoli Directory Server (CVE-2013-6747)

Abstract A vulnerability has been identified in the GSKit component utilized by IBM Security Directory Server ISDS and IBM Tivoli Directory Server TDS. A malformed certificate chain can cause the ISDS or TDS client application or server process using GSKit to hang or crash. Remediation for the...

Security Bulletin: GSKit SSL negotiation vulnerability in Tivoli Directory Server (CVE-2013-6329)

Abstract A vulnerability has been identified in the GSKit component utilized by Tivoli Directory Server TDS. A specially crafted SSL message can cause the TDS server component using GSKit to crash. Remediation for the issue consists of upgrading affected GSKit following the instructions at the en...

Security Bulletin: Multiple JRE vulnerabilities addressed in IBM Sterling Secure Proxy (CVE-2013-0440, CVE-2013-0443, CVE-2013-0169)

Abstract The IBM JRE embedded in the IBM Sterling Secure Proxy Configuration Manager has security vulnerabilities that affect SSL connections to the configuration GUI. Content VULNERABILITY DETAILS CVE ID : CVE-2013-0440 DESCRIPTION: A vulnerability in Java Runtime Environment allows remote...

Security Bulletin: InfoSphere Guardium Data Redaction affected by SSL vulnerability in Apache Axis2 (CVE-2012-5785)

Abstract An SSL vulnerability exists in Apache Axis which is used by InfoSphere Guardium Data Redaction to process HTTPS requests from the Redaction SOAP API . Content VULNERABILITY DETAILS: CVE ID: CVE-2012-5785 DESCRIPTION: Apache Axis2/Java, as used in multiple products, could allow a remote...

Security Bulletin: GSKit SSL/TLS Record Length vulnerability in Tivoli Directory Server (CVE-2012-2191)

Abstract A vulnerability has been identified in the GSKit component utilized by Tivoli Directory Server TDS. A specifically crafted malformed SSL/TLS data packet can cause the TDS server using GSKit to segmentation fault.. Remediation for the issue consists of updating GSKit 7 to version 7.0.4.41...

Security Bulletin: An IBM Business Process Manager SSL connection can be established without host name verification: CVE-2012-5785

Abstract A Secure Sockets Layer SSL connection can be established without host name verfication, which can make the connection vulnerable to a man-in-the-middle attack. Content While obtaining an SSL connection, the IBM Business Process Management BPM system does not validate the host name of the...