IT25380: A local user could corrupt or delete highly sensitive information that may cuase a denial of service

APAR status

• Closed as program error.

Error description

• When DSMC starts up, the new SSL information in 8.1.2 and 7.1.8
  creates several files as world writable in the config directory.
  World writable files and directories on machines with local
  untrusted users may cause a denial of service to other users.
  
  Products affected:
  IBM Spectrum Protect for Virtual Environments: Data Protection
  for VMware version 8.1.2, 8.1.4 running on Linux x86 platform.
  
  This problem also affects IBM Spectrum Protect Backup-Archive
  Client which is the data mover for Data Protection for
  VMware 7.1.8 and higher. If you are using
  Data Protection for VMware 7.1.8 and higher refer to APAR
  IT23846.
  

Local fix

• Manually change the permissions on the files and directories
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * For additional information, refer to the security bulletin   *
  * published here:                                              *
  * https://www-01.ibm.com/support/docview.wss?uid=ibm10719401   *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * This issue is projected to be fixed in the Data Protection   *
  * for VMware Data Mover version 8.1.6 on Linux x86_64          *
  * platform.                                                    *
  * Note 1: This is subject to change at the discretion of IBM.  *
  ****************************************************************
  

Problem conclusion

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  IT23846

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TSM FOR VE DP V

• Fixed component ID

  5725TVEVM

Applicable component levels