PH42292: THE HTTP LISTENER IS VULNERABLE TO DOS (DENIAL OF SERVICE) ATTACKS

APAR status

• Closed as program error.

Error description

• The HTTP Listener SSL communication module (m4gskssl.so) is not
  properly configured to deny client initiated SSL renegotiation.
  

Local fix

• ITXCQ - ITX00060936
  GM / CF
  Circumvention: None
  

Problem summary

• Users Affected:
  IBM Transformation Extender users using GSK and HTTP listener.
  
  Problem Description:
  The HTTP Listener is vulnerable to DoS (Denial of Service)
  attacks.
  
  Platforms Affected:
  Windows, All Unix
  

Problem conclusion

• Issue is resolved in latest GSK updates. If any customer needs
  existing behavior, they need to set below environment variables
  :
  DST_GSK_ALLOW_ABBREVIATED_RENEGOTIATION=TRUE
  
  Applies to:
  9.0.0.4, 10.0.0.0, 10.1.0.0, 10.1.1.0
  
  Fixed in the next service packs and releases.
  
  To obtain the fix for this APAR:
  
  To see if the next service pack or product release is available,
  check the IBM Transformation Extender Release Notes page:
  https://www.ibm.com/support/docview.wss?uid=swg27008337
  
  If the service pack or product release is available, download it
  from Fix Central:
  http://www.ibm.com/support/fixcentral/
  
  If the service pack or product release is not available and you
  require the APAR fix immediately, request a Limited Availability
  Interim Fix (LAIF) by opening a case:
  https://www.ibm.com/mysupport/
  
  Prior to version 9.0.0, IBM Transformation Extender was called
  IBM WebSphere Transformation Extender.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  ITX

• Fixed component ID

  5724Q2300

Applicable component levels