IBM Security Bulletin: IBM® DB2® LUW is vulnerable to Sweet32 Birthday Attack (CVE-2016-2183)

GSKit is an IBM component that is used by IBM DB2 for SSL support. The GSKit that is shipped with IBM DB2 is vulnerable to the Sweet32 Birthday attack. By default, DB2 does not use SSL for client-server communication and therefore DB2 is vulnerable only if SSL is enabled and a Triple-DES cipher is selected.

CVE(s): CVE-2016-2183

Affected product(s) and affected version(s):

All fix pack levels of IBM DB2 V9.7, V10.1, V10.5 and V11.1 editions listed below and running on AIX, Linux, HP, Solaris or Windows are affected
IBM® DB2® Express Edition
IBM® DB2® Workgroup Server Edition
IBM® DB2® Enterprise Server Edition
IBM® DB2® Advanced Enterprise Server Edition
IBM® DB2® Advanced Workgroup Server Edition
IBM® DB2® Direct Advanced Edition
IBM® DB2® Direct Standard Edition
IBM® DB2® Connect™ Application Server Edition
IBM® DB2® Connect™ Enterprise Edition
IBM® DB2® Connect™ Unlimited Edition for System i®
IBM® DB2® Connect™ Unlimited Edition for System z®

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/2hPLPfq
X-Force Database: http://ift.tt/2dR3VyC

from IBM Product Security Incident Response Team http://ift.tt/2hPLNUQ