IBM Security Bulletin: Vulnerabilities in OpenSSL affect AIX

OpenSSL vulnerabilities were disclosed on September 22 and 26, 2016 by the OpenSSL Project. OpenSSL is used by AIX. AIX has addressed the applicable CVEs.

CVE(s):CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE-2016-6306, CVE-2016-7052

Affected product(s) and affected version(s):

 AIX 5.3, 6.1, 7.1, 7.2
VIOS 2.2.x
The following fileset levels are vulnerable:
key_fileset = osrcaix
Fileset Lower Level Upper Level KEY --------------------------------------------------
openssl.base 1.0.1.500 1.0.1.516 key_w_fs
openssl.base 1.0.2.500 1.0.2.800 key_w_fs
openssl.base 20.11.101.500 20.11.101.501 key_w_fs
Note: 0.9.8 openSSL version is out-of-support. Customers are advised
to upgrade to currently supported openSSL 1.0.2 version.
Note: To find out whether the affected filesets are installed on your systems, refer to the lslpp command found in the AIX user's
guide.
Example: lslpp -L | grep -i openssl.base

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/2ggdYfh
X-Force Database: http://ift.tt/2e0d1c6
X-Force Database: http://ift.tt/2dyLfjk
X-Force Database: http://ift.tt/2fn0LCi
X-Force Database: http://ift.tt/2ggdWUA
X-Force Database: http://ift.tt/2fn3PhD
X-Force Database: http://ift.tt/2ggduG8
X-Force Database: http://ift.tt/2fn630l
X-Force Database: http://ift.tt/2gggD91
X-Force Database: http://ift.tt/2fn9oNh
X-Force Database: http://ift.tt/2ggdLbX
X-Force Database: http://ift.tt/2fnbCMj
X-Force Database: http://ift.tt/2ggdKEV

from IBM Product Security Incident Response Team http://ift.tt/2fn3Div