IT10723: STERLING B2B INTEGRATOR IS AFFECTED BY CLICK JACKING VULNERABILITY

si_52_build_5020500_interimfix_8
si_52_build_5020500_interimfix_8
si_52_build_5020500_interimfix_8

APAR status

• Closed as program error.

Error description

• A Click jacking (also known as a "UI redress attack")
  vulnerability has been discovered in IBM Sterling B2B
  Integrator.
  
  Sterling B2B Integrator Standard Edition could allow a
  remote attacker to hijack the clicking action of the victim. By
  persuading a victim to visit a malicious Web site, a remote
  attacker could send a specially crafted HTTP request to hijack
  the victim's click actions or launch other client side browser
  attacks.
  

Local fix

• STRRTC - 472342
  LRB / MK
  Circumvention: None
  

Problem summary

• Users Affected:
  ALL
  
  Problem Description:
  IBM Sterling B2B Integrator Standard Edition could
  allow a remote attacker to hijack the clicking action of the
  victim. By persuading a victim to visit a malicious Web site, a
  remote attacker could send a specially crafted HTTP request to
  hijack the victim's click actions or launch other client side
  browser attacks.
  
  Platforms Affected:
  All
  

Problem conclusion

• Resolution Summary:
  A code fix has been provided.
  See the security Bulletin at
  http://www.ibm.com/support/docview.wss?uid=swg21965734
  
  Delivered in:
  5020500_8
  5104_8
  5105
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STR B2B INTEGRA

• Fixed component ID

  5725D0600

Applicable component levels