Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2012.0061
Possible security exposure for WebSphere Application Server
on IBM i (PM49712) (CVE-2011-1376)
16 January 2012
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Websphere Application Server
Publisher: IBM
Operating System: UNIX variants (UNIX, Linux, OSX)
Impact/Access: Access Privileged Data -- Existing Account
Modify Arbitrary Files -- Existing Account
Delete Arbitrary Files -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2011-1376
Original Bulletin:
http://xforce.iss.net/xforce/xfdb/71230
- --------------------------BEGIN INCLUDED TEXT--------------------
Possible security exposure for WebSphere Application Server on IBM i (PM49712)
(CVE-2011-1376)
Flash (Alert)
Abstract
Native file permissions for WebSphere Application Server are incorrect on IBM
i operating systems.
Content
CVE ID: CVE-2011-1376
Versions affected:
This only occurs on the following:
IBM® WebSphere® Application Server for IBM i operating systems for Versions
6.1 through 6.1.0.41, 7.0 through 7.0.0.19, and 8.0 through 8.0.0.1.
This does not occur on:
IBM WebSphere Application Server Versions prior to Version 6.1.
IBM WebSphere Application Server for distributed operating systems, IBM
WebSphere Application Server for z/OS operating systems, or IBM WebSphere
Application Server Hypervisors.
Problem Description:
Native file permissions for WebSphere Application Server are incorrect on IBM i
operating systems.
CVSS:
CVSS Base Score: 4.4
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/71230 for the
current score.
CVSS Environmental Score*: Undefined
CVSS String: (AV:L/AC:M/Au:N/C:P/I:P/A:P)
Solutions:
Applying the appropriate Interim Fix APAR PM49712, or a PTF group containing
the APAR (see below), will address this issue.
For IBM WebSphere Application Server for IBM i operating systems:
For V8.0 through 8.0.0.1:
Apply Interim Fix APAR PM49712
--OR--
Apply the WebSphere Application Server PTF group which includes Fix
Pack 2 (8.0.0.2), or later, (targeted to be available 16 January 2012)
according to the PTF group instructions.
Note: If you use the Web-based ("live") repository provided by IBM,
Installation Manager (IM) will, by default, pick up any recommended Interim
Fixes (iFix) when installing WebSphere Application Sever V8 or any of its V8
Service Fix Packs. As a result, the iFix may already be installed. ld bIf you
are unsure as to whether or not it is installed, you can check either using
the IM GUI by selecting "File->View Installed Packages" or using the IM
command line "imcl listInstalledPackages -long".
For V7.0 through 7.0.0.19:
Apply Interim Fix APAR PM49712
--OR--
Apply the WebSphere Application Server PTF group which includes Fix
Pack 21 (7.0.0.21), or later, (targeted to be available 16 January 2012)
according to the PTF group instructions.
For V6.1 through 6.1.0.41:
Apply Interim Fix APAR PM49712
--OR--
Apply the WebSphere Application Server PTF group which includes Fix
Pack 43 (6.1. 0.43), or later, (targeted to be available 19 March 2012)
according to the PTF group instructions.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBTxNuO+4yVqjM2NGpAQIPJg/8DJB2mOAH9fpuKuEym0IHXwwltFVHq7Gl
5jB6mb0Umz0MUtx2Z6hPgB4uTL2uwvhGq7kkCIAPP7BACuUfB/62lq+SXYN3KwCR
JeMTKaXxAmyzIvLwPhjNMI1K8YW6Kf5FRTVWbh0sVNs/pngRkXYwrLYaWj2fc3BY
Z4ArWZNSm0ECFrHAZHwS8TNELhplHzsCBRoMdi9APQQtO7WoVz/+DQm+sQ0VwGnU
HR5bt6HhwteXQfaoKiML0OARS+7CAVWo/LHgQ5Q7h1DrgIw8SOyrYg9az6tVQrHL
6ygkIlIeQ2Y6S48Wt/ELv9JK7cG5aN2DdNd1qy2Kf+UF5eo9SYgYmwaSYbOADlfG
zMMmfIUIiXljXoDdN3ccYhqSg007UiwJjdBdXZR3Vil7bin6OP1ix/oCdVK2q1h5
9HAZz0ZLujKprGLv7YfUCuqxJFNgchBYbLFpIYyOj9o/js/ZryuyP+u4jBwxE2+P
QSyWwn4hKdSVjSVtxh9rWwtdZ/OzJ3lmV6rIfTywNT1UV5saDSIzl6O1j+goX4Wi
cBJmu/A/ixRqr05aA2IhHgUBi8KiSum6IUPwYpen07Ceg2jW4r7ZN2en5DJUiLqM
KXYx8GxMYSM3DVTLBhBCCKnsRGliolE5Egr2K5XPtggmLhEyDtbHZdVuPRiIXlIf
DFp4lzyasXM=
=n7X4
-----END PGP SIGNATURE-----