Townsend Security Data Privacy Blog

IBM i Security Notification - OpenSSL and OpenVPN

Posted by Patrick Townsend on Nov 8, 2016 8:46:49 AM

In case you missed it, IBM just released a security notification for the IBM i platform - all versions of the operating system from 6.1 through 7.3. This one is important and you should take a look at it right away. The vulnerabilities are related to OpenSSL and to OpenVPN which uses OpenSSL. The vulnerability is called the SWEET32 Birthday attack. OpenSSL is used in several places on the IBM i platform, so patching this should be a priority.

alert.pngHere is the link to the description of the problem and a list of the PTFs that you need to apply for all currently supported platforms. Be sure to read it all the way through.

I recommend that you follow the guidance in this document to turn off Triple DES ciphers.

In addition to patching the IBM instances of OpenSSL and OpenVPN, IBM recommends that you contact your third party software vendors to determine if they have vulnerabilities.

Let me be pre-emptive here:

None of the Townsend Security solutions for the IBM i use the OpenSSL library for secure TLS sessions. Our solutions exclusively use the IBM i System TLS library. Why is that? Well, we ported OpenSSL to the IBM i platform more than 10 years ago. While we were successful with the port to the IBM i, I made a decision that we would not release it nor use it in our IBM i products. OpenSSL is a complex application with many moving parts. I agree with Bruce Schneier that complexity is the enemy of security. It is so easy to introduce a problem in a cryptographic library even if you work in this area a great deal. I felt then, and I feel now, that the maintenance and support of the TLS library should remain with IBM and that the native IBM i System TLS library is the best platform for us and our customers. I believe that this was a good decision then, and remains a good decision now. It has protected our customers from a number of security problems.

Our Managed FTP solution does use the OpenSSH solution for secure FTP sessions. OpenSSH uses the OpenSSL solution for cryptographic operations, but not for secure session establishment and it is not subject to this vulnerability. We use the IBM OpenSSH distribution and not our own port of OpenSSH for the very same reason as above.

I am NOT criticizing the OpenSSL development team. I’ve worked directly with the OpenSSL team over the years and have deep respect for them. They have a gargantuan task in maintaining one of the most widely used secure communications products in the world. Security programming will humble you and, if you are lucky, it will make you risk averse. On the IBM i platform we chose to use the IBM i System TLS library and I still think that was a wise decision.

There are multiple third-party IBM i products that do use their own version of OpenSSL. You need to be talking to them right away. Unfortunately I know of one or two that are no longer supporting the IBM i platform. So you may have some difficulty getting resolution on this issue. I wish you luck in this endeavor!

If you are interested you can read about the SWEET32 attack here.

If you are one of our IBM i customers I recommend that you sign up for our newsletter. If you’ve opted out in the past you might not be getting security notifications from us. When you opt out we honor that request and won’t opt you back in. You have to do that here. 

Patrick

Webinar: Sec

Topics: IBM i