Re: Heartbleed report

Saw that. It was right on

https://www-304.ibm.com/connections/blogs/PSIRT/entry/openssl_heartbleed_cve_2014_0160?lang=en_us

I'm running with that info. Boss is cool.

Me to Boss:
With the statement from IBM at that link that Domino and IBM i is good,
and a resolve to upgrade the firmware on the tape library at some point
near in the future,
and Linoma saying they are not susceptible to Heartbleed,
and Arpeggio saying they are not susceptible to Heartbleed,
are we good in closing out our concerns regarding Heartbleed?

Possible additional concerns may be obsolete software like Quickr.
However, these are so old as to predate the version of SSL that introduced
Heartbleed.

Boss to me:
Thank You for your thorough research.

Now to attend the COMMON announcement on Power 8 and IBM i 7.2 in 10
minutes...


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: Anthony Dezanet <adezanet@xxxxxxxxxx>
To: "Lotus Domino on the IBM i \(AS/400 and iSeries\)"
<domino400@xxxxxxxxxxxx>
Date: 04/28/2014 09:25 AM
Subject: Re: Heartbleed report
Sent by: "Domino400" <domino400-bounces@xxxxxxxxxxxx>



Hi Rob,

This technote might help you:
http://www-01.ibm.com/support/docview.wss?uid=swg21669782


Regards,

ANTHONY M. (TONY) DEZANET
Staff Software Engineer - Lotus Connections

Phone: 1-800-426-7378
E-mail: adezanet@xxxxxxxxxx


1475 Phoenixville Pike
West Chester, PA 19380-1437
United States




From:
rob@xxxxxxxxx
To:
domino400@xxxxxxxxxxxx
Date:
04/28/2014 09:16 AM
Subject:
Heartbleed report



We have benevolent hacking from Network Solutions.
http://www.networksolutions.com

Help me interpret this report.
*********************************
Network guy sent it to me as a screenshot so I'm transcribing it to text
(list is text only)

Issue Details
Reason for escalation: The Heartbleed Bug is a serios vulnerability in
the popular OpenSSL cryptographic software library. This weakness allows
stealing the information protected, under normal contidions, by the SL/TLS


encryption used to secure the Internet. SSL/TLS provides communication
security and privacy over the Internet for applications such as web,
email, instant messaging (IM and some virtual private networks (VPNs).

Issue Code: SI Unauthorized Access

Device name:
dekko-grrt-us-g1
dekko-kend-us-g1

Attack Name: TLS Heartbeat Short Request

Destination:
208.87.180.51
208.87.180.52
208.87.182.51
208.87.182.52

End of Report
********************************

Guess what those four IP addresses are?
www.dekkocustomers.com
www.dekkosuppliers.com
Primary in one city, secondary in another city.
Served up on IBM i 7.1
IBM Domino (r) Server (Release 9.0.1 for i5/OS)

I have three Domino lpars down, supporting multiple Domino servers each.
Boss says figuring this heartbleed issue out takes priority.




Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com

--
This is the Lotus Domino on the IBM i (AS/400 and iSeries) (Domino400)
mailing list
To post a message email: Domino400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/domino400
or email: Domino400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/domino400.



--
This is the Lotus Domino on the IBM i (AS/400 and iSeries) (Domino400)
mailing list
To post a message email: Domino400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/domino400
or email: Domino400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/domino400.

--
This is the Lotus Domino on the IBM i (AS/400 and iSeries) (Domino400)
mailing list
To post a message email: Domino400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/domino400
or email: Domino400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/domino400.