IBM Information for VU#104280

Multiple vulnerabilities in SSL/TLS implementations

Status

Affected

Vendor Statement

[AIX]

The AIX Security Team is aware of the issues discussed in CERT Vulnerability Notes VU#255484, VU#380864, VU#686224, VU#935264 and VU#732952.

OpenSSL is available for AIX via the AIX Toolbox for Linux. Please note that the Toolbox is made available "as-is" and is unwarranted. The Toolbox ships with OpenSSL 0.9.6g which is vulnerable to the issues referenced above. A patched version of OpenSSL will be provided shortly and this vendor statement will be updated at that time.

Please note that OpenSSH, which is made available through the Expansion Pack is not vulnerable to these issues.

[eServer]

IBM eServer Platform Response

For information related to this and other published CERT Advisories that may relate to the IBM eServer Platforms (xSeries, iSeries, pSeries, and zSeries) please go to https://app-06.www.ibm.com/servers/resourcelink/lib03020.nsf/pages/securityalerts?OpenDocument&pathID=

In order to access this information you will require a Resource Link ID. To subscribe to Resource Link go to
http://app-06.www.ibm.com/servers/resourcelink and follow the steps for registration.

All questions should be refered to servsec@us.ibm.com.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Vendor References

None

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.