DB2 FOR LUW / DB2FORLUW / 970 - DB2

The TLS padding vulnerability could allow a remote attacker to 
obtain sensitive information, caused by the failure to check the 
contents of the padding bytes when using CBC cipher suites of 
some TLS implementations. A remote user with the ability to 
conduct a man-in-the-middle attack could exploit this 
vulnerability via a POODLE (Padding Oracle On Downgraded Legacy 
Encryption) like attack to decrypt sensitive information and 
calculate the plaintext of secure connections. 
 
Customers have Secure Sockets Layer (SSL) support enabled in 
their DB2 database system are affected. SSL support is not 
enabled in DB2 by default.

**************************************************************** 
* USERS AFFECTED:                                              * 
* All DB2 systems on all Linux, Unix and Windows platforms at  * 
* service levels Version 9.7 GA  through to Version 9.7 Fix    * 
* Pack 10.                                                     * 
**************************************************************** 
* PROBLEM DESCRIPTION:                                         * 
* See Error Description                                        * 
**************************************************************** 
* RECOMMENDATION:                                              * 
* Upgrade to DB2 Version 9.7 Fix Pack 11.                      * 
* Refer to security bulletin for details:                      * 
* http://www-01.ibm.com/support/docview.wss?uid=swg21693011    * 
****************************************************************

This problem can be mitigated by setting the operating system 
environment variable GSK_STRICTCHECK_CBCPADBYTES=GSK_TRUE. 
Please refer to security bulletin for detail mitigation 
instruction : 
http://www-01.ibm.com/support/docview.wss?uid=swg21692618

The complete fix for this problem first appears in DB2 Version 
9.7 Fix Pack 11 and all the subsequent Fix Packs.

not known / see Local fix

Date  - problem reported    :
Date  - problem closed      :
Date  - last modified       :

07.01.2015
08.10.2015
08.10.2015

9.7.FP11