PI09443: Potential denial of service vulnerability in IBM HTTP Server

Download Description

PI09443 resolves the following problem:

USERS AFFECTED:
Users of IBM HTTP Server with SSL enabled.

PROBLEM DESCRIPTION:
A GSKit security library problem could result in hang or crash of IBM HTTP Server.

RECOMMENDATION:
Apply this fix if using IBM HTTP Server with SSL enabled.

PROBLEM CONCLUSION:
The GSKit security library was updated to resolve the issue.

This fix is targeted for IBM HTTP Server fixpacks:
- 7.0.0.33
- 8.0.0.9
- 8.5.5.2

IBM HTTP Server is distributing an updated GSKit security library as an interim fix.
The fix for PI08502 is also included in this interim fix.
No configuration is required once GSKit is updated to 7.0.4.48 or 8.0.50.17.

Note: For IHS 8.5.5, the fix is in the 8.5.5.2 fixpack , but "CVE-2013-6747" will not be listed in
the '-V' output until the 8.5.5.3 fixpack.


For IHS version 8.0 and 8.5:

The interim fix can be installed using Installation Manager (IM) with the Web-based ("live") repository provided by IBM. It may be necessary to de-select the "Show recommended only" option within IM and to expand "Only fixes for version 8.x.y.z" to see the fix listed.
The interim fix is also available from Fix Central at the link listed in the Download Package section below.

For IHS versions prior to 8.0:

This standalone GSKit update has been published to the IBM HTTP Server Fixes download site,
and is located under the 'GSKit Version 7' section for your platform. Click 'here' to be taken to the login page.

For IBM HTTP Server 6.x releases, download the GSKit 7.0.4.48 package and Readme
under the section labeled 'PI09443 - IHS Version 6'

For IBM HTTP Server 7.0 releases, download the GSKit 7.0.4.48 package and Readme
under the section labeled 'PI09443 - IHS Version 7'