IV94012: SWEET32 PSIRT REMEDIATION(CVE-2016-2183)

6.3.0.7-TIV-ITM_TEMA-IF0004
6.3.0.7-TIV-ITM_TEMA-IF0005
6.3.0.7-TIV-ITM_TEMA-IF0006
6.3.0.7-TIV-ITM_TEMA-IF0007

IBM Tivoli Monitoring Basic Services Vulnerability (IV94012)
IBM Tivoli Monitoring 6.3.0 Fix Pack 7 Service Pack 1 (6.3.0.7-TIV-ITM-SP0001)

APAR status

• Closed as program error.

Error description

• CVE-2016-2183 describes a confidentiality leak when Triple-DES
  (3DES) 64-bit block cipher is negotiated and used to transmit
  hundreds of gigabytes of information.
  

Local fix

• Disable TLS1.0 and TLS1.1 via IV82451 or via the following
  configuration:
  
  KDEBE_TLSV10_CIPHER_SPECS=""
  KDEBE_TLSV11_CIPHER_SPECS=""
  
  OR keep TLS1.0 and TLS1.1 active and remove the unwanted 3DES
  ciphers with the following configuration:
  
  KDEBE_TLSV10_CIPHER_SPECS="TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_
  WITH_AES_256_CBC_SHA"
  KDEBE_TLSV11_CIPHER_SPECS="TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_
  WITH_AES_256_CBC_SHA"
  

Problem summary

• CVE-2016-2183 describes a confidentiality leak when
  Triple-DES(3DES) 64-bit block cipher is negotiated and used to
  transmit hundreds of gigabytes of information.
  

Problem conclusion

• Added code to remove the usage of the weak ciphers
  
  
  The fix for this APAR is contained in the following maintenance
  packages:
  
     | service pack | 6.3.0.7-TIV-ITM-SP0001
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TEMS

• Fixed component ID

  5724C04MS

Applicable component levels