1-800-477-6473 Ready to Talk?

Feedback

Did this article resolve your question/issue?

Article

Are the Connect/Connect64 for ODBC drivers affected by CVE-2016-2183 and CVE-2016-6329?

Information

Title	Are the Connect/Connect64 for ODBC drivers affected by CVE-2016-2183 and CVE-2016-6329?

URL Name	are-the-connect-connect64-for-odbc-drivers-affected-by-cve-2016-2183-and-cve-2016-6329

Article Number	000179691

Environment	Product: Progress DataDirect for ODBC Version: 8.0 Product: Connect/Connect64 for ODBC drivers Version: 7.1.6 OS: All supported platforms Database: All supported databases Application: All supported applications

Question/Problem Description

Are the Connect/Connect64 for ODBC drivers affected by CVE-2016-2183 and CVE-2016-6329 ?

Steps to Reproduce

Clarifying Information

Error Message

Defect Number

Enhancement Number

Cause

Resolution

CVE-2016-2183

This flaw is related to the design of the DES/3DES cipher and is not an implementation flaw.
OpenSSL have rated this as a 'low' severity security issue.
To avoid this vulnerability, it is advised to disable the DES/3DES and consider it bad as "RC4"

Mitigation: for actions to avoid this vulnerability, please contact Supportlink and refer to this article.

CVE-2016-6329

This vulnerability is the same as CVE-2016-2183, however for OpenVPN.
The Connect/Connect64 for ODBC drivers do not use OpenVPN.

Workaround

Notes

Last Modified Date	4/19/2023 8:41 PM

Files

Disclaimer

The origins of the information on this site may be internal or external to Progress Software Corporation (“Progress”). Progress Software Corporation makes all reasonable efforts to verify this information. However, the information provided is for your information only. Progress Software Corporation makes no explicit or implied claims to the validity of this information.

Any sample code provided on this site is not supported under any Progress support program or service. The sample code is provided on an "AS IS" basis. Progress makes no warranties, express or implied, and disclaims all implied warranties including, without limitation, the implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample code is borne by the user. In no event shall Progress, its employees, or anyone else involved in the creation, production, or delivery of the code be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample code, even if Progress has been advised of the possibility of such damages.

Progress, Telerik, Ipswitch, Chef, Kemp, Flowmon and certain product names used herein are trademarks or registered trademarks of Progress Software Corporation and/or one of its subsidiaries or affiliates in the U.S. and/or other countries. See Trademarks for appropriate markings.