* * * READ ME * * *
                 * * * Symantec HA Console 6.0.1 * * *
                      * * * Patch 6.0.1.003 * * *
                         Patch Date: 2014-05-02


This document provides the following information:

   * PATCH NAME
   * OPERATING SYSTEMS SUPPORTED BY THE PATCH
   * PACKAGES AFFECTED BY THE PATCH
   * BASE PRODUCT VERSIONS FOR THE PATCH
   * SUMMARY OF INCIDENTS FIXED BY THE PATCH
   * DETAILS OF INCIDENTS FIXED BY THE PATCH
   * INSTALLATION PRE-REQUISITES
   * INSTALLING THE PATCH
   * REMOVING THE PATCH


PATCH NAME
----------
Symantec HA Console 6.0.1 Patch 6.0.1.003


OPERATING SYSTEMS SUPPORTED BY THE PATCH
----------------------------------------
Windows 2008 X64
Windows Server 2008 R2 X64



BASE PRODUCT VERSIONS FOR THE PATCH
-----------------------------------
   * Symantec HA Console 6.0.1


SUMMARY OF INCIDENTS FIXED BY THE PATCH
---------------------------------------
Patch ID: Hotfix_6_0_10003_3487042
* 3487042 (3487042) The Symantec High Availability Console uses an affected version of OpenSSL and may be vulnerable to the HeartBleed bug.


DETAILS OF INCIDENTS FIXED BY THE PATCH
---------------------------------------
This patch fixes the following Symantec incidents:

Patch ID: Hotfix_6_0_10003_3487042

* 3487042 (Tracking ID: 3487042)

SYMPTOM:
The Symantec High Availability Console uses an affected version of OpenSSL and may be vulnerable to the HeartBleed bug.

DESCRIPTION:
A security bug (The HeartBleed Bug) affected OpenSSL. 
The Symantec High Availability Console uses an affected version of OpenSSL and may be vulnerable to this bug in the following scenarios:

- Guest components (Symantec Cluster Server (VCS) and Symantec ApplicationHA) installation is invoked from VMware vSphere Client menu
If the VCS or ApplicationHA guest components installation is invoked from within the vSphere Client menu, 
the High Availability Console uses OpenSSL to exchange information with the systems selected for installation.
Note: This issue does not have an impact if guest components are installed directly using the installer wizard or 
program, or using response files, or by running commands from the command prompt.
The affected product versions and their respective platforms are as follows:
- VCS (Linux): 6.0.2

- Virtual machines are configured for auto recovery
When “Virtual Machine Auto Recovery” feature is configured for virtual machines that are under ApplicationHA control, 
the High Availability Console uses OpenSSL to communicate with the Backup Exec Media Server that hosts the virtual machine backup information.
The affected product version is ApplicationHA 6.1 for VMware (on Windows)

RESOLUTION:
Symantec has modified the code to fix this vulnerability.
This hotfix provides the modified versions of certain installation files. These modified files address the issue. 

File Name / Version:
ApplyPatch.bat
patch.pl
RHEL5/
   libcrypto.so.1.0.0
   libssl.so.1.0.0
RHEL6/
   libcrypto.so.1.0.0
   libssl.so.1.0.0
SLES10/
   libcrypto.so.1.0.0
   libssl.so.1.0.0
SLES11/
   libcrypto.so.1.0.0
   libssl.so.1.0.0
WIN/
   libeay32.dll
   ssleay32.dll
HA_CONSOLE32/
   libeay32.dll
   ssleay32.dll
HA_CONSOLE64/
   libeay32.dll
   ssleay32.dll
   openssl.exe



INSTALLING THE PATCH
--------------------
To install the hotfix, perform the following steps on the Symantec High Availability Console host:
1. Download the hotfix zip file, Hotfix_6_0_10003_3487042.zip, and extract the contents to a temporary location. 

2. Navigate to the temporary location where you had extracted the contents of the hotfix.

3. Navigate to the "patches" folder and run the ApplyPatch.bat file.
   This copies the modified installation files to its respective location on the Console host and the command output displays the status for each supported guest operating system.
Note:
If you run the CopyInstaller.bat file after installing the hotfix, then the modified installation files are again replaced with the earlier versions (vulnerable files).
To address this issue, you must re-install the hotfix after the CopyInstaller.bat file is executed successfully.


REMOVING THE PATCH
------------------
NA


SPECIAL INSTRUCTIONS
--------------------
Disclaimer
This fix is provided without warranty of any kind including the warranties of title or implied warranties of merchantability, fitness for a particular purpose and non-infringement. Symantec disclaims all liability relating to or arising out of this fix. It is recommended that the fix be evaluated in a test environment before implementing it in your production environment. When the fix is incorporated into a Storage Foundation for Windows maintenance release, the resulting Hotfix or Service Pack must be installed as soon as possible. Symantec Technical Services will notify you when the maintenance release (Hotfix or Service Pack) is available if you sign up for notifications from the Symantec support site http://www.symantec.com/business/support and/or from Symantec Operations Readiness Tools (SORT) http://sort.symantec.com.


OTHERS
------
NONE