PK63182: SSL SETTING "SECURITY LEVEL" SHOULD LIMIT THE CIPHERS BEING USED BUT DOES NOT.

Java SDK 1.5 SR8 Cumulative Fix for WebSphere Application Server
Java SDK 1.5 SR10 Cumulative Fix for WebSphere Application Server
6.1.0.31: Java SDK 1.5 SR11 FP1 Cumulative Fix for WebSphere Application Server
6.1.0.33: Java SDK 1.5 SR12 FP1 Cumulative Fix for WebSphere
6.1.0.29: Java SDK 1.5 SR11 Cumulative Fix for WebSphere Application Server
6.1.0.35: Java SDK 1.5 SR12 FP2 Cumulative Fix for WebSphere
6.1.0.37: Java SDK 1.5 SR12 FP3 Cumulative Fix for WebSphere
6.1.0.39: Java SDK 1.5 SR12 FP4 Cumulative Fix for WebSphere Application Server
6.1.0.41: Java SDK 1.5 SR12 FP5 Cumulative Fix for WebSphere Application Server
6.1.0.43: Java SDK 1.5 SR13 Cumulative Fix for WebSphere Application Server
6.1.0.45: Java SDK 1.5 SR14 Cumulative Fix for WebSphere Application Server
6.1.0.47: WebSphere Application Server V6.1 Fix Pack 47
6.1.0.47: Java SDK 1.5 SR16 Cumulative Fix for WebSphere Application Server

APAR status

• Closed as program error.

Error description

• In the sas.client.props configuration file the Quality of
  Protection property or in the left hand side of Admin Console
  navigation the SSL Configuration settings, the attribute
  "Security Level" can be set to Low, Medium, or High which
  should dictate the level of encryption used by limiting the
  selection of cipher suites.
  
  However, this setting is not taking affect, as specifying
  Security Level = HIGH should use only 128-bit encryption, but
  the following 56-bit ciphers are still used:
  
  SSL_RSA_WIT_DES_CBC_SHA
  SSL_DHE_RSA_WITH_DES_CBC_SHA
  SSL_DHE_DSS_WITH_DES_CB_SHA
  
  Also, specifying Security Level = LOW should use NO encryption,
  but ciphers with encryption are still used, such as:
  
  SSL_RSA_WITH_RC4_128_MD5
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server V6.1                                 *
  ****************************************************************
  * PROBLEM DESCRIPTION: For WebSphere Application Server, the   *
  *                      cipher suite groups available for an    *
  *                      SSL configuration do not properly       *
  *                      show strong ciphers when STRONG group   *
  *                      is selected or weak ciphers when the    *
  *                      WEAK group is selected. The list of     *
  *                      ciphers includes ciphers with 56-bit    *
  *                      key strength, whereas the list of       *
  *                      weak ciphers allow ciphers with         *
  *                      encryption.                             *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  For WebSphere Application Server, an SSL configuration
  with STRONG or WEAK cipher groups has ciphers that are either
  not strong enough or the ciphers have encryption. A strong
  cipher must provide at least a 128-bit key whereas a weak
  cipher must not provide encryption.
  Examples of ciphers listed not meeting the strong criterion
  are:
  SSL_RSA_WIT_DES_CBC_SHA
  SSL_DHE_RSA_WITH_DES_CBC_SHA
  SSL_DHE_DSS_WITH_DES_CB_SHA
  An example of a cipher listed not meeting the weak criterion
  is:
  SSL_RSA_WITH_RC4_128_MD5
  

Problem conclusion

• The code was modified to adjust the ciphers listed for an SSL
  configuration according to the STRONG and WEAK ciphers criteria.
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 6.1.0.21.  Please refer to the Recommended Updates
  page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPH APP SERV

• Fixed component ID

  5724J0800

Applicable component levels

• R61A PSY

     UP

• R61H PSY

     UP

• R61I PSY

     UP

• R61P PSY

     UP

• R61S PSY

     UP

• R61W PSY

     UP

• R61Z PSY

     UP