IBM Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM Spectrum Protect (formerly Tivoli Storage Manager) Client and IBM Spectrum Protect (formerly Tivoli Storage Manager) for Virtual Environments: Data Protection for VMware

OpenSSL vulnerabilities were disclosed on January 28, 2016, March 1, 2016, May 3, 2016, and September 22 and 26, 2016 by the OpenSSL Project. OpenSSL, used by the IBM Spectrum Protect (formerly Tivoli Storage Manager) Client and IBM Spectrum Protect for Virtual Environments (formerly Tivoli Storage Manager for Virtual Environments): Data Protection from VMware, has addressed the applicable CVEs.

CVE(s): CVE-2016-0701, CVE-2015-3197, CVE-2016-0705, CVE-2016-0798, CVE-2016-0797, CVE-2016-0799, CVE-2016-0702, CVE-2016-2842, CVE-2016-2107, CVE-2016-2105, CVE-2016-2106, CVE-2016-2109, CVE-2016-2176, CVE-2016-2108, CVE-2016-6302, CVE-2016-6304, CVE-2016-6305, CVE-2016-6303, CVE-2016-2182, CVE-2016-2180, CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-6306, CVE-2016-6307, CVE-2016-2183, CVE-2016-6309, CVE-2016-7052, CVE-2016-6308, CVE-2016-2181

Affected product(s) and affected version(s):

These security exposures affect network connections between IBM Spectrum Protect (formerly Tivoli Storage Manager) and VMware services. This exposure affects:

• IBM Spectrum Protect (formerly Tivoli Storage Manager) Client levels:
  – 7.1.0.0 through 7.1.6.4
  – 6.4 all levels
  – 6.3 all levels (6.3 is EOS)

  Note that the 8.1 client is not affected because the affected component in 8.1 has been moved to Data Protection for VMware.

  • IBM Spectrum Protect for Virtual Environments (formerly Tivoli Storage Manager for Virtual Environments): Data Protection for VMware levels:
    – 8.1.0.0 through 8.1.0.1
    – 7.1.0.0 through 7.1.6.4
    – 6.4 all levels
    – 6.3 all levels (6.3 is EOS)

    Note that for 8.1, the affected component was moved from the Client to DP for VMware.
    

    Refer to the following reference URLs for remediation and additional vulnerability details:
    Source Bulletin: http://ift.tt/2ro8NkE
    X-Force Database: http://ift.tt/1W1VuQf
    X-Force Database: http://ift.tt/1rd26hw
    X-Force Database: http://ift.tt/1Tg5wqO
    X-Force Database: http://ift.tt/1N2N4p3
    X-Force Database: http://ift.tt/1Tg5wqQ
    X-Force Database: http://ift.tt/1N2N4p5
    X-Force Database: http://ift.tt/1Tg5v6h
    X-Force Database: http://ift.tt/24fOBfM
    X-Force Database: http://ift.tt/1NwOQz5
    X-Force Database: http://ift.tt/1NwOPLs
    X-Force Database: http://ift.tt/25myFMu
    X-Force Database: http://ift.tt/1Z0wO8Z
    X-Force Database: http://ift.tt/25mym4p
    X-Force Database: http://ift.tt/1VjTr9i
    X-Force Database: http://ift.tt/2dR4fNY
    X-Force Database: http://ift.tt/2dmY7tO
    X-Force Database: http://ift.tt/2dR3XX1
    X-Force Database: http://ift.tt/2dmXjFz
    X-Force Database: http://ift.tt/2dR45pA
    X-Force Database: http://ift.tt/2dmWOvf
    X-Force Database: http://ift.tt/2aPXjQq
    X-Force Database: http://ift.tt/2asKHex
    X-Force Database: http://ift.tt/2dR5fBu
    X-Force Database: http://ift.tt/2dmYpRr
    X-Force Database: http://ift.tt/2dR3Smm
    X-Force Database: http://ift.tt/2dR3VyC
    X-Force Database: http://ift.tt/2fn8D82
    X-Force Database: http://ift.tt/2dTp6vD
    X-Force Database: http://ift.tt/2dmYa8Y
    X-Force Database: http://ift.tt/2dmXLUk

    The post IBM Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM Spectrum Protect (formerly Tivoli Storage Manager) Client and IBM Spectrum Protect (formerly Tivoli Storage Manager) for Virtual Environments: Data Protection for VMware appeared first on IBM PSIRT Blog.

from IBM Product Security Incident Response Team http://ift.tt/2roneVY