APAR status
Closed as program error.
Error description
IBM Sterling File Gateway could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection (XXE) error when processing XML data. An attacker could declare an entity referencing the content of a local file to obtain sensitive information.
Local fix
Problem summary
Users Affected: All Sterling B2B Integrator and Sterling File Gateway users. Problem Description: IBM Sterling File Gateway could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection (XXE) error when processing XML data. An attacker could declare an entity referencing the content of a local file to obtain sensitive information. Platforms Affected: All
Problem conclusion
Resolution Summary: A code fix has been applied. See the Security Bulletin for more information: http://www-01.ibm.com/support/docview.wss?rs=2310&uid=swg2169948 2 Delivered In: 5020500_3 5104_7
Temporary fix
Comments
APAR Information
APAR number
IT06733
Reported component name
STR FILE GATEWA
Reported component ID
5725D0700
Reported release
224
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2015-01-26
Closed date
2015-03-23
Last modified date
2015-05-01
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
STR FILE GATEWA
Fixed component ID
5725D0700
Applicable component levels
R225 PSY
UP
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SS4TGX","label":"IBM Sterling File Gateway"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"2.2","Edition":"","Line of Business":{"code":"LOB59","label":"Sustainability Software"}}]
Document Information
Modified date:
01 May 2015