IT13955: FIX 5.X SECURITY VULNERABILITY FOR OPEN SSL - CVE-2015-3193 CVE-2015-3194 CVE-2015-3195 CVE-2015-3196

TPC 5.1.1.10 - AIX Server Files
TPC 5.1.1.10 - Linux Server Files
TPC 5.1.1.10 - Windows Server Files
TPC 5.1.1.10 - Agent Files
IBM Spectrum Control V5.2.9 (February 2016)
IBM Spectrum Control V5.2.10 (May 2016)
IBM Spectrum Control V5.2.10.1 (July 2016)
IBM Spectrum Control V5.2.11 (August 2016)
Fix Pack 5.1.1.12 (October 2016) for Tivoli Storage Productivity Center
Fix Pack 5.1.1.13 (February 2017) for Tivoli Storage Productivity Center
Fix Pack 5.1.1.14 (June 2017) for Tivoli Storage Productivity Center
Fix Pack 5.1.1.15 (Sept 2017) for Tivoli Storage Productivity Center
IBM Spectrum Control V5.2.12 (November 2016)
IBM Spectrum Control V5.2.13 (March 2017)
IBM Spectrum Control V5.2.14 (May 2017)
IBM Spectrum Control V5.2.15 (August 2017)
IBM Spectrum Control V5.2.15.2 (November 2017)
IBM Spectrum Control V5.2.16 (March 2018)
IBM Spectrum Control V5.2.17 (May 2018)

APAR status

• Closed as program error.

Error description

• Tivoli Storage Productivity Center and IBM Spectrum Control are
  affected by
  vulnerabilities in OpenSSL (CVE-2015-3193 CVE-2015-3194
  CVE-2015-3195 CVE-2015-3196)
  
  Versions affected include:
  IBM Spectrum Control 5.2.8
  Tivoli Storage Productivity Center 5.2.0 through 5.2.7
  Tivoli Storage Productivity Center 5.1.0 through 5.1.1.9
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * TPC 5.2.x and Spectrum Control 5.2.8 users.                  *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See security bulletin for details.                           *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fix maintenance as recommended by the security         *
  * bulletin.  Additional steps may be necessary.                *
  ****************************************************************
  

Problem conclusion

• Security bulletin:
  http://www-01.ibm.com/support/docview.wss?uid=swg21977355
  
  The fix for this APAR is targeted for the following maintenance
  package:
  
  | refresh pack | 5.2-TIV-TPC-RP0009 - Feb 2016
  
  Fixed in IBM Spectrum Control 5.2.9.
  
  http://www-01.ibm.com/support/docview.wss?&uid=swg21320822
  
  The target dates for future refresh packs do not represent a
  formal commitment by IBM. The dates are subject to change
  without notice.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• OPENSSL
  

Fix information

• Fixed component name

  TPC

• Fixed component ID

  5608TPC00

Applicable component levels