JR57932: DataStage XML Import is vulnerable to an XXE vulnerability

APAR status

• Closed as program error.

Error description

• DataStage XML Import is vulnerable to an XXE vulnerability
  

Local fix

• Import using dsx format, or manually review XML files for
  unexpected DTD content
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users of DataStage project import using xml exports
  ****************************************************************
  PROBLEM DESCRIPTION:
  The xml import can be compromised by editing the xml and or
  default stylesheets prior to import, this forces the style sheet
  to process DTD entries in such a way that user written code can
  be executed.
  ****************************************************************
  RECOMMENDATION:
  The problem is resolved in 11.7 releases of the product.
  A patch for 11.5 releases is available from IBM support.
  Refer to Security bulletin for details.
  http://www.ibm.com/support/docview.wss?uid=swg22005803
  ****************************************************************
  

Problem conclusion

• The client code has been modified to allow the control of DTD
  processing.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WIS DATASTAGE

• Fixed component ID

  5724Q36DS

Applicable component levels