DB2 - Problembeschreibung
Problem IT06351 | Status: Geschlossen |
SECURITY: TLS padding vulnerability affects IBM© DB2© LUW (CVE-2014-8730) | |
Produkt: | |
DB2 FOR LUW / DB2FORLUW / A50 - DB2 | |
Problembeschreibung: | |
The TLS padding vulnerability could allow a remote attacker to obtain sensitive information, caused by the failure to check the contents of the padding bytes when using CBC cipher suites of some TLS implementations. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) like attack to decrypt sensitive information and calculate the plaintext of secure connections. Customers have Secure Sockets Layer (SSL) support enabled in their DB2 database system are affected. SSL support is not enabled in DB2 by default. | |
Problem-Zusammenfassung: | |
**************************************************************** * USERS AFFECTED: * * All DB2 systems on all Linux, Unix and Windows platforms at * * service levels Version 10.5 GA through to Version 10.5 Fix * * Pack 5. * **************************************************************** * PROBLEM DESCRIPTION: * * See Error Description * **************************************************************** * RECOMMENDATION: * * Upgrade to DB2 Version 10.5 Fix Pack 6. * * Refer to security bulletin for details: * * http://www-01.ibm.com/support/docview.wss?uid=swg21693011 * **************************************************************** | |
Local-Fix: | |
This problem can be mitigated by setting the operating system environment variable GSK_STRICTCHECK_CBCPADBYTES=GSK_TRUE. Please refer to security bulletin for detail mitigation instruction : http://www-01.ibm.com/support/docview.wss?uid=swg21692618 | |
Lösung | |
The complete fix for this problem first appears in DB2 Version 10.5 Fix Pack 6 and all the subsequent Fix Packs. | |
Workaround | |
keiner bekannt / siehe Local-Fix | |
Weitere Daten | |
Datum - Problem gemeldet : Datum - Problem geschlossen : Datum - der letzten Änderung: | 07.01.2015 27.08.2015 27.08.2015 |
Problem behoben ab folgender Versionen (IBM BugInfos) | |
Problem behoben lt. FixList in der Version | |
10.5.0.6 |