IT07314: FIX TPC 5.X SECURITY VULNERABILITY FOR OPENSSL - CVE-2014-3513, CVE-2014-3567, CVE-2014-3568

Tivoli Storage Productivity Center Refresh Pack 5
Tivoli Storage Productivity Center 5.1.1.6
Fix Pack 5.1.1.9 (October 2015) for Tivoli Storage Productivity Center
IBM Spectrum Control V5.2.8 (December 2015)
IBM Spectrum Control V5.2.9 (February 2016)
IBM Spectrum Control V5.2.10 (May 2016)
IBM Spectrum Control V5.2.10.1 (July 2016)
IBM Spectrum Control V5.2.11 (August 2016)
Fix Pack 5.1.1.12 (October 2016) for Tivoli Storage Productivity Center
Fix Pack 5.1.1.13 (February 2017) for Tivoli Storage Productivity Center
Fix Pack 5.1.1.14 (June 2017) for Tivoli Storage Productivity Center
Fix Pack 5.1.1.15 (Sept 2017) for Tivoli Storage Productivity Center
IBM Spectrum Control V5.2.12 (November 2016)
IBM Spectrum Control V5.2.13 (March 2017)
IBM Spectrum Control V5.2.14 (May 2017)
IBM Spectrum Control V5.2.15 (August 2017)
IBM Spectrum Control V5.2.15.2 (November 2017)
IBM Spectrum Control V5.2.16 (March 2018)
IBM Spectrum Control V5.2.17 (May 2018)
Refresh Pack 5.2.5 (March 2015) for Tivoli Storage Productivity Center (withdrawn)
Fix Pack 5.1.1.6 (March 2015) for Tivoli Storage Productivity Center
Fix Pack 5.2.5.1 (April 2015) for Tivoli Storage Productivity Center (withdrawn)
Refresh Pack 5.2.6 (June 2015) for Tivoli Storage Productivity Center
Fix Pack 5.1.1.8 (July 2015) for Tivoli Storage Productivity Center
Refresh Pack 5.2.7 (August 2015) for Tivoli Storage Productivity Center
Fix Pack 5.2.7.1 (February 2016) for Tivoli Storage Productivity Center

APAR status

• Closed as program error.

Error description

• Tivoli Storage Productivity Center is affected by
  vulnerabilities in OpenSSL (CVE-2014-3513, CVE-2014-3567,
  CVE-2014-3568)
  
  TPC versions affected include:
  Tivoli Storage Productivity Center 5.2.0 through 5.2.4.1
  Tivoli Storage Productivity Center 5.1.0 through 5.1.1.5
  Tivoli Storage Productivity Center 4.2.0 through 4.2.2.184
  Tivoli Storage Productivity Center 4.1.x
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * Tivoli Storage Productivity Center 5.2.0 through 5.2.4.1     *
  * Tivoli Storage Productivity Center 5.1.0 through 5.1.1.5     *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * Tivoli Storage Productivity Center is affected by            *
  * vulnerabilities in OpenSSL (CVE-2014-3513, CVE-2014-3567,    *
  * CVE-2014-3568)                                               *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Refer to details in the security bulletin.                   *
  ****************************************************************
  

Problem conclusion

• Read and follow directions from the security bulletin.
  Security Bulletin: Tivoli Storage Productivity Center is
  affected by vulnerabilities in OpenSSL (CVE-2014-3513,
  CVE-2014-3567, CVE-2014-3568)
  http://www.ibm.com/support/docview.wss?uid=swg21694996
  
  The fix for this APAR is targeted for the following maintenance
  package:
  
  | refresh pack | 5.2-TIV-TPC-RP0005 - March 2015
  | fix pack | 5.1.1-TIV-TPC-FP0006 - March 2015
  
  http://www-01.ibm.com/support/docview.wss?&uid=swg21320822
  
  See APAR IT07318 for TPC 4.x.
  The target dates for future refresh packs do not represent a
  formal commitment by IBM. The dates are subject to change
  without notice.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  IT07318

Modules/Macros

• SSL
  

Fix information

• Fixed component name

  TPC

• Fixed component ID

  5608TPC00

Applicable component levels