JR52067: ENABLE STRICT PADDING FOR CVE-2014-8730

Communications Server for Windows, Version 6.4 -- Latest Fixpack

APAR status

• Closed as program error.

Error description

• Communications Server for Windows, v6.4 and v6.1.3
  --------------------------------------------------
  Product could allow a remote attacker to obtain sensitive
  information, caused by the failure to check the contents of the
  padding bytes when using CBC cipher suites of some TLS
  implementations. A remote user with the ability to conduct a
  man-in-the-middle attack could exploit this vulnerability via a
  POODLE (Padding Oracle On Downgraded Legacy Encryption) like
  attack to decrypt sensitive information and calculate the
  plaintext of secure connections.
  

Local fix

Problem summary

• Product could allow a remote attacker to obtain sensitive
  information, caused by the failure to check the contents of the
  padding bytes when using CBC cipher suites of some TLS
  implementations. A remote user with the ability to conduct a
  man-in-the-middle attack could exploit this vulnerability via a
  POODLE (Padding Oracle On Downgraded Legacy Encryption) like
  attack to decrypt sensitive information and calculate the
  plaintext of secure connections.
  

Problem conclusion

• The TN3270 Server code has been modified to enable strict
  padding check. Clients that do not implement padding correctly
  may not be able to connect.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  JR52061

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  COMM SERV NT 6.

• Fixed component ID

  5639F2503

Applicable component levels

• R640 PSY