9.1 Patch 5 and 9.2 Patch 1 for IBM Endpoint Manager Platform

Release Announcements Platform (Release Announcements)
1

The IBM Endpoint Manager team is releasing 9.1 Patch 5 and 9.2 Patch 1 of the IBM Endpoint Manager platform. These new versions address security updates, including the POODLE vulnerability, and fixes from older versions of OpenSSL. The new patches use OpenSSL 1.0.1.j.

IBM recommends upgrading whenever possible to take advantage of optimizations and bug fixes. Because these vulnerabilities are not of a critical nature, the upgrade should not be done in haste, but as part of a planned upgrade process.

Upgrade fixlets are available starting from BES Support version 1199.

Here are some details of the patches:

9.1 Patch 5 (9.1.1229.0)

Changelist

  • Fixes for POODLE, OpenSSL, and XSS security issues
  • Fixes for general platform issues

Get more information by reading the full technical changelist or the detailed description of the security vulnerabilities.

Components Affected

All components (Server components, Console, Relays, Agents) are included in this update.

9.2 Patch 1 (9.2.1.48)

Changelist

  • Fixes for POODLE, OpenSSL, and XSS security issues
  • Fixes for general platform issues
  • FillDB performance tuning though configuration settings

Get more information by reading the full technical changelist or the detailed description of the security vulnerabilities.

Components Affected

All components (Server components, Console, Relays, Agents) are included in this update.

This announcement was also made available via Endpoint Management blog via developerWorks.

1 Like
2

All 9.1 versions are affected by this vulnerability?

3

With respect to the POODLE vulnerability, prior to 9.1 Patch 5 (9.1.1229), the platform components allowed the usage of SSL3 (unless the Enhanced security feature was enabled). Starting with 9.1 Patch 5, SSL3 is disabled by default.

4
1 Like
5

Anyone successfully upgraded from 9.2 to 9.2.1, we just initiated the fixlet and no one can connect to the server via the console after receiving database version mismatch errors.

6

If you haven’t already, please contact support.

The 9.2 Patch 1 has a database upgrade from 9.2 Patch 0. As such, the Console must be upgraded to 9.2 Patch 1 to connect to a 9.2 Patch 1 Root Server.

7

Looks like we just didn’t wait long enough, after about an hour we were able to log in successfully.

8

Hello,

Is it neccesary if we don’t use encrypted reports(MLE)?

9

The vulnerabilities addressed by these versions do not only affect MLE (HTTPS is leveraged even without MLE enabled).