IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Spectrum Protect (formerly Tivoli Storage Manager) Client and IBM Spectrum Protect (formerly Tivoli Storage Manager) for Virtual Environments: Data Protection for VMware

OpenSSL vulnerabilities were disclosed on January 26, 2017 by the OpenSSL Project. OpenSSL, used by the IBM Spectrum Protect (formerly Tivoli Storage Manager) Client and IBM Spectrum Protect for Virtual Environments (formerly Tivoli Storage Manager for Virtual Environments): Data Protect for VMware, has addressed the applicable CVEs.

CVE(s): CVE-2017-3731, CVE-2017-3732, CVE-2016-7055

Affected product(s) and affected version(s):

These security exposures affect network connections between IBM Spectrum Protect (formerly Tivoli Storage Manager) and NetApp and VMware services. This exposure affects:

• IBM Spectrum Protect (formerly Tivoli Storage Manager) Client levels:
  – 8.1.0.0 through 8.1.2.x – NetApp services
  – 7.1.0.0 through 7.1.7.x – NetApp and VMware services
  – 6.4 and below all levels – NetApp and VMware services (6.4 and below are EOS)

  Note that VMware services for the 8.1 client are not affected because the affected component in 8.1 has been moved to Data Protection for VMware.

  • IBM Spectrum Protect for Virtual Environments (formerly Tivoli Storage Manager for Virtual Environments): Data Protection for VMware levels:
    – 8.1.0.0 through 8.1.2.x – VMware services
    – 7.1.0.0 through 7.1 7.x – VMware services
    – 6.4 and below all levels – VMware services (6.4 and below are EOS)

    Refer to the following reference URLs for remediation and additional vulnerability details:
    Source Bulletin: http://ift.tt/2lEi704
    X-Force Database: http://ift.tt/2knsB3D
    X-Force Database: http://ift.tt/2kDymIW
    X-Force Database: http://ift.tt/2hjUUfe

    The post IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Spectrum Protect (formerly Tivoli Storage Manager) Client and IBM Spectrum Protect (formerly Tivoli Storage Manager) for Virtual Environments: Data Protection for VMware appeared first on IBM PSIRT Blog.

from IBM Product Security Incident Response Team http://ift.tt/2lFE3YG