IT08318: FIX SECURITY VULNERABILITY CVE-2015-2808 FOR TPC 4.x

TPC_5.2.5.1_NL_windows_disk1_part1
TPC_5.2.5.1_SRA
TPC_5.2.5.1_NL_aix_disk1_part1
TPC_5.2.5.1_NL_linux_ix86_disk1_part1
Tivoli Storage Productivity Center 5.2.5.1
TPC 5.1.1.7 - Agent Files
TPC 5.1.1.7 - AIX Server Files
TPC 5.1.1.7 - Linux Server Files
TPC 5.1.1.7 - Windows Server Files
Tivoli Storage Productivity Center 5.1.1.7
Fix Pack 5.2.5.1 (April 2015) for Tivoli Storage Productivity Center (withdrawn)
Refresh Pack 5.2.6 (June 2015) for Tivoli Storage Productivity Center
Refresh Pack 5.2.7 (August 2015) for Tivoli Storage Productivity Center
Fix Pack 5.1.1.9 (October 2015) for Tivoli Storage Productivity Center
IBM Spectrum Control V5.2.8 (December 2015)
IBM Spectrum Control V5.2.9 (February 2016)
IBM Spectrum Control V5.2.10 (May 2016)
IBM Spectrum Control V5.2.10.1 (July 2016)
IBM Spectrum Control V5.2.11 (August 2016)
Fix Pack 5.1.1.12 (October 2016) for Tivoli Storage Productivity Center
Fix Pack 5.1.1.13 (February 2017) for Tivoli Storage Productivity Center
Fix Pack 5.1.1.14 (June 2017) for Tivoli Storage Productivity Center
Fix Pack 5.1.1.15 (Sept 2017) for Tivoli Storage Productivity Center
IBM Spectrum Control V5.2.12 (November 2016)
IBM Spectrum Control V5.2.13 (March 2017)
IBM Spectrum Control V5.2.14 (May 2017)
IBM Spectrum Control V5.2.15 (August 2017)
IBM Spectrum Control V5.2.15.2 (November 2017)
IBM Spectrum Control V5.2.16 (March 2018)
IBM Spectrum Control V5.2.17 (May 2018)
Fix Pack 5.1.1.8 (July 2015) for Tivoli Storage Productivity Center
Fix Pack 5.2.7.1 (February 2016) for Tivoli Storage Productivity Center

APAR status

• Closed as program error.

Error description

• Security update for vulnerability CVE-2015-2808
  
  
  Affected versions:
  Tivoli Storage Productivity Center 4.2.x
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * TPC 5.2.x and 5.1.x users                                    *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * Vulnerability in RC4 stream cipher affects Tivoli Storage    *
  * Productivity Center (CVE-2015-2808)                          *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * See security bulletin for details.                           *
  * http://www.ibm.com/support/docview.wss?uid=swg21883158       *
  ****************************************************************
  

Problem conclusion

• See security bulletin for full details on resolving the
  vulnerability.
  http://www.ibm.com/support/docview.wss?uid=swg21883158
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  IT08539

Modules/Macros

• SECURITY
  

Fix information

• Fixed component name

  TPC

• Fixed component ID

  5608TPC00

Applicable component levels