Security Bulletin: Vulnerability in SSLv3 affects IBM Sterling Connect:Direct for i5/OS (CVE-2014-3566)

Sign on as the Connect:Direct Administrator and use the SPADMIN command to remove SSL protocol from any Secure+ definitions, use TLS instead. The same would need to occur on your remote Connect:Direct servers.

To make sure SSL is never used, from a 5250 command line:

WRKSYSVAL SYSVAL(QSSL*)

Note: You must have *IOSYSCFG, *ALLOBJ, and *SECADM special authorities to change this system value.

When managing the list of supported SSL protocols:

• Enter 5 to display QSSLPCL: This will display one of two things:

1. *OPSYS: Which indicates the default protocols for the OS release are supported. To see what those defaults protocols actually are, reference the IBM Knowledge center for the appropriate OS release.
2. A manually defined list of the SSL protocols currently supported by the system

• Enter 2 to edit QSSLPCL: *OPSYS is the default value. To add or remove an SSL protocol, the *OPSYS value must be removed and replaced with a complete list of all the SSL protocols you want to support. To see what the defaults protocols actually are and the list of protocols available, reference the IBM Knowledge Center for the appropriate OS release.

Note: If an error is reported when attempting to modify the protocol list indicating that the QSSLCSL system value must be updated first, it means that the cipher specifications needed to support the protocols aren't present. They either have to be added manually or QSSLCSLCTL set to *OPSYS, so they can be added for you.

IBM recommends that you review your entire environment to identify areas that enable the SSLv3 protocol and take appropriate mitigation and remediation actions. The most immediate mitigation action that can be taken is disabling SSLv3.