A security issue and a vulnerability have been reported in IBM Global Security Toolkit (GSKit), which can be exploited by malicious people to conduct spoofing attacks and cause a DoS (Denial of Service).

1) An error due to the validity of added Certificate Objects not being properly verified can be exploited to spoof a valid server and e.g. conduct Man-in-the-Middle (MitM) attacks.

2) An error due to incoming data not being properly handled when defending against the Vaudenay SSL CBC Timing attack can be exploited to cause a crash.

The security issue and vulnerability are reported in:
* GSKit versions prior to 7.0.4.42 and 8.0.14.22.
* IBM Rational Directory Server versions 5.2.0.2, 5.2.0.1, and 5.2.
* IBM Tivoli Access Manager for e-business versions 6.0.x and 6.1.x

Solution
Update GSKit to version 7.0.4.42 or 8.0.14.22.
Further details available to Secunia VIM customers

Provided and/or discovered by
Reported by the vendor

Changelog
Further details available to Secunia VIM customers

Original Advisory
IBM:
http://www.ibm.com/support/docview.wss?uid=swg21606145
http://www.ibm.com/support/docview.wss?uid=swg21612378
http://www.ibm.com/support/docview.wss?uid=swg21612390

Deep Links
Links available to Secunia VIM customers