IT06200: TLS PADDING VULNERABILITY AFFECTS IBM STERLING CONNECT:DIRECT FOR MICROSOFT WINDOWS (CVE-2014-8730)

4.7.0.3-SterlingConnectDirectforMicrosoftWindows-x86-fp0003
4.7.0.3-SterlingConnectDirectforMicrosoftWindows-x86-fp0003-if002
4.7.0.3-SterlingConnectDirectforMicrosoftWindows-x86-fp0003-if005
4.7.0.3-SterlingConnectDirectforMicrosoftWindows-x86-fp0003-if012
4.7.0.3-SterlingConnectDirectforMicrosoftWindows-x86-fp0003-if015
4.7.0.3-SterlingConnectDirectforMicrosoftWindows-x86-fp0003-if020
4.7.0.4-SterlingConnectDirectforMicrosoftWindows-x86-fp0004
4.7.0.4-SterlingConnectDirectforMicrosoftWindows-x86-fp0004-if007
4.7.0.4-SterlingConnectDirectforMicrosoftWindows-x86-fp0004-if016
4.7.0.5-SterlingConnectDirectforMicrosoftWindows-x86-fp0005
4.7.0.4-SterlingConnectDirectforMicrosoftWindows-x86-fp0004-if023
4.7.0.5-SterlingConnectDirectforMicrosoftWindows-x86-fp0005-if006
4.7.0.5-SterlingConnectDirectforMicrosoftWindows-x86-fp0005-if013
4.7.0.5-SterlingConnectDirectforMicrosoftWindows-x86-fp0005-if016
4.7.0.5-SterlingConnectDirectforMicrosoftWindows-x86-fp0005-if025
4.7.0.6-SterlingConnectDirectforMicrosoftWindows-x86-fp0006
4.7.0.6-SterlingConnectDirectforMicrosoftWindows-x86-fp0006-if005
4.7.0.6-SterlingConnectDirectforMicrosoftWindows-x86-fp0006-if006
4.7.0.6-SterlingConnectDirectforMicrosoftWindows-x86-fp0006-if012
4.7.0.7-SterlingConnectDirectforMicrosoftWindows-x86-fp0007
4.7.0.7-SterlingConnectDirectforMicrosoftWindows-x86-fp0007-if001
4.7.0.7-SterlingConnectDirectforMicrosoftWindows-x86-fp0007-if009
4.7.0.7-SterlingConnectDirectforMicrosoftWindows-x86-fp0007-if016
4.7.0.7-SterlingConnectDirectforMicrosoftWindows-x86-fp0007-if018
4.7.0.7-SterlingConnectDirectforMicrosoftWindows-x86-fp0007-if021
4.7.0.7-SterlingConnectDirectforMicrosoftWindows-x86-fp0007-if023

APAR status

• Closed as program error.

Error description

• A Transport Layer Security (TLS) padding vulnerability via a
  POODLE (Padding Oracle On Downgraded Legacy Encryption) like
  attack affects IBM Sterling Connect:Direct for Microsoft
  Windows.
  

Local fix

• STRRTC - 451116
  VF / VF
  Circumvention: None
  

Problem summary

• Users Affected:
  Sterling Connect:Direct for Windows 4.7.0
  
  Problem Description:
  A Transport Layer Security (TLS) padding vulnerability via a
  POODLE (Padding Oracle On Downgraded Legacy Encryption) like
  attack affects IBM Sterling Connect:Direct for Microsoft
  Windows.
  
  Platforms Affected:
  Windows
  

Problem conclusion

• Resolution Summary:
  Enabled the GSK_STRICTCHECK_CBCPADBYTES setting in GSKit to
  check for strict compliance with the TLS RFC.
  
  Delivered In:
  Sterling Connect:Direct for Windows 4.7.0.2_iFix007
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STR CD FOR WIND

• Fixed component ID

  5725C9908

Applicable component levels