IBM Tivoli Firewall Toolbox, version 1.2

INTRODUCTION

Ubizen, a provider of Managed Security Solutions, has identified a potential buffer overflow security vulnerability with the IBM Tivoli Firewall Toolbox, version 1.2.  This vulnerability has been corrected in IBM Tivoli’s Firewall Toolbox, version 1.3, which is available for download through the IBM.com support site.

LAST UPDATE

This information is current as of March 19th,2003.

DETAILS

The IBM Tivoli Firewall Toolbox provides the underlying communication for the framework-based applications within a firewalled environment.  This is an optional component, and not part of the base installation for IBM Tivoli Management Environment.  The vulnerability was discovered in this communication layer, and if left unchecked, can potentially expose that system to remote access by an unauthorized user, who could exploit the vulnerability and compromise the operation of the Tivoli environment within the firewalled environment.  

The updated version of the Tivoli Firewall Toolbox (version 1.3) remedies this potential exposure in the product and is freely available.  Please see ‘Fix Location’ for information on how to obtain this latest upgrade. For further information regarding this vulnerability, please refer to the notice at

http://www.ibm.com/software/sysmgmt/products/support/IBMTivoliManagementFramework.html, and select the ‘Support Flashes’ link.

SOLUTION

IBM Tivoli Firewall Toolbox, version 1.3 corrects this exposure in the product and is freely available.  IBM strongly encourages all users of IBM Tivoli Firewall Toolbox, version 1.2 to install this updated version as soon as possible to remedy this potential vulnerability

Please see ‘Fix Location’ for information on how to obtain this latest upgrade.

FIX LOCATION

Download of version 1.3 of the IBM Tivoli Firewall Toolbox can be found at:

http://www-3.ibm.com/software/sysmgmt/products/support/IBMTivoliManagementFramework.html (Entitled Customers only)

ftp://ftp.software.ibm.com/software/tivoli_support/patches/patches_1.3 (anonymous access)

QUESTIONS

For any questions, support can be obtained through the following means:

·            Local call center

·            Create PMR through the online support page

Please refer to http://www-3.ibm.com/software/sysmgmt/products/support/ for information regarding these options.