IC87282: SUPPORT FOR SSL COMPRESSION ALLOWS "CRIME" ATTACK (CVE-2012-4929)

APAR status

• Closed as program error.

Error description

• Any implementation of HTTPS that supports compression at the SSL
  level is vulnerable to the "CRIME" attack also known as
  CVE-2012-4929.
  
  DataPower appliance with firmware >= 3.7.3.0 support SSL level
  compression, and are thus potentially vulnerable to this attack.
  

Local fix

Problem summary

• Affected are users of HTTP over SSL on DataPower firmware
  releases >= 3.7.3.0 since these releases support SSL level
  compression.  These users might be affected by the "CRIME"
  attack (CVE-2012-4929).
  

Problem conclusion

• The fix (the removal of support for SSL level compression) is
  available in 3.8.2.16, 4.0.1.14, 4.0.2.10, and 5.0.0.4.
  
  For a list of the latest fix packs available, please see:
  http://www-01.ibm.com/support/docview.wss?uid=swg21237631
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  DATAPOWER

• Fixed component ID

  DP1234567

Applicable component levels

• R382 PSY

     UP

• R401 PSY

     UP

• R402 PSY

     UP

• R500 PSY

     UP

• R380 PSN

     UP

• R381 PSN

     UP