<html><body>
<p><font size="2" face="sans-serif">9.1.1082 (9.1 patch 1) is an emergency patch release to close the OpenSSL</font><br>
<font size="2" face="sans-serif">Heartbleed vulnerability (CVE-2014-0160). This is a critical vulnerability that</font><br>
<font size="2" face="sans-serif">affects 9.1 servers and relays. If you are running a 9.1 deployment, you</font><br>
<font size="2" face="sans-serif">need to upgrade immediately in order to close the vulnerability.</font><br>
<br>
<font size="2" face="sans-serif">Only deployments running 9.1.1065 are exposed to the Heartbleed vulnerability.</font><br>
<font size="2" face="sans-serif">Earlier versions are not vulnerable. After upgrading from 9.1.1065 to 9.1.1082,</font><br>
<font size="2" face="sans-serif">the following steps should be performed to revoke any potentially-compromised</font><br>
<font size="2" face="sans-serif">credentials (these steps do not need to be performed if upgrading from 9.0 or</font><br>
<font size="2" face="sans-serif">earlier):</font><br>
<font size="2" face="sans-serif"> 1) Rotate the server signing key:</font><br>
<font size="2" face="sans-serif"> </font><a href="http://www-01.ibm.com/support/docview.wss?uid=swg21669587"><font size="2" face="sans-serif">http://www-01.ibm.com/support/docview.wss?uid=swg21669587</font></a><br>
<font size="2" face="sans-serif"> 2) Rotate custom SSL certificates in Web Reports or the Root Server, if</font><br>
<font size="2" face="sans-serif"> you are using them (note: this is not common).</font><br>
<font size="2" face="sans-serif"> 3) Change all Console user passwords (especially master operator passwords)</font><br>
<font size="2" face="sans-serif"> 4) Change any database or network proxy passwords that are in root server </font><br>
<font size="2" face="sans-serif"> or relay settings.</font><br>
<font size="2" face="sans-serif"> 5) Rotate the client keys for all relays, especially DMZ relays, using Fixlet</font><br>
<font size="2" face="sans-serif"> 1759 in the BES Support site (or</font><br>
<font size="2" face="sans-serif"> </font><a href="http://www-01.ibm.com/support/docview.wss?uid=swg21670787"><font size="2" face="sans-serif">http://www-01.ibm.com/support/docview.wss?uid=swg21670787</font></a><font size="2" face="sans-serif"> for manual</font><br>
<font size="2" face="sans-serif"> instructions).</font><br>
<br>
<font size="2" face="sans-serif">9.1.1065 agents are also exposed to the Reverse Heartbleed vulnerability, but</font><br>
<font size="2" face="sans-serif">can only be exploited by an attacker setting up a new relay that the agent </font><br>
<font size="2" face="sans-serif">connects to. If you suspect this type of attack has occurred, please contact</font><br>
<font size="2" face="sans-serif">support for recommendations.</font><br>
<br>
<font size="2" face="sans-serif">* Detailed changelist: </font><a href="http://support.bigfix.com/bes/changes/fullchangelist-91.txt"><font size="2" face="sans-serif">http://support.bigfix.com/bes/changes/fullchangelist-91.txt</font></a><br>
<font size="2" face="sans-serif">* Known issues: </font><a href="http://www-01.ibm.com/support/docview.wss?uid=swg21667537"><font size="2" face="sans-serif">http://www-01.ibm.com/support/docview.wss?uid=swg21667537</font></a><br>
<font size="2" face="sans-serif">* Upgrade fixlets available in BES Support version 1161</font><br>
<br>
</body></html>