Security Bulletin: Potential security exposure with IBM HTTP Server 8.0 and earlier (PM46234) (CVE-2011-3192)

Remediation/Fixes

Apply Interim Fix APAR PM46234, or a Fix Pack containing this APAR, resolves this issue.

For IBM HTTP Server for distributed operating systems:

For Version 8.0:

• Apply Interim Fix APAR PM46234.

--OR--

• Apply Fix Pack 1, or later (8.0.0.1) (projected to be available 26 September 2011).

For Versions 7.0 and 7.0.0.19:

• Apply Fix Pack 15, 17 or 19 (7.0.0.15, 7.0.0.17, 7.0.0.19), if not already at that level, then
• Apply Interim Fix APAR PM46234.

--OR--

• Apply Fix Pack 21, or later (7.0.0.21) (projected to be available 9 January 2012).

For Versions 6.1 through 6.1.0.39:

• Apply Fix Pack 35, 37 or 39 (6.1.0.35, 6.1.0.37, 6.1.0.39), if not already at that level, then
• Apply Interim Fix APAR PM46234.

--OR--

• Apply Fix Pack 41, or later (6.1.0.41) (projected to be available 17 November 2011).

For Versions 6.0 through 6.0.2.42:

• Apply Fix Pack 43 (6.0.2.43), if not already at that level, then
• Apply Interim Fix APAR PM46234.

Note:

• IBM HTTP Server Version 6.0.x was provided with WebSphere Application Server Version 6.0, which is no longer in service (ended September 2010).
• Additional assistance will only be provided if you have a support extension contract in place, with the purchase of a support extension contract, or if you are otherwise entitled to support through another product.

For Versions 2.0 (2.0.42 and 2.0.47):

• Contact IBM Technical Support for a PM46234 cumulative ifix (projected to be available 16 September 2011).
• IBM HTTP Version 2.0.42 was provided with WebSphere Application Server Version 5.0, and IBM HTTP Server Version 2.0.47 was provided with WebSphere Application Server Version 5.1.
• WebSphere App Server Version 5.0 is no longer in service (ended September 2006).
• WebSphere App Server Version 5.1 is no longer in service (ended September 2008).
• Additional assistance will only be provided if you have a support extension contract in place, with the purchase of a support extension contract, or if you are otherwise entitled to support through another product.

For IBM HTTP Server for z/OS (powered by Apache):

For V8.0.0.0:

• Apply APAR PM46234 by way of the appropriate Cumulative APAR (Fix Pack) for 8.0.0.1, or later (targeted to be available September 2011) (FMID: HBBO800)

For V7.0.0.0 through 7.0.0.18:

• Apply APAR PM46234 by way of the appropriate Cumulative APAR (Fix Pack) for 7.0.0.19, or later (targeted to be available September 2011) (FMID: HHAP700)

For V6.1.0.0 through 6.1.0.39:

• Apply APAR PM46234 by way of the appropriate Cumulative APAR (Fix Pack) for 6.1.0.41, or later (targeted to be available November 2011) (FMID: JIWO610)

Note: Customers may chose to follow the directions "For Circumvention" as a temporary solution, or while waiting for the Cumulative APAR containing this solution.


For IBM WebSphere Application Server Hypervisor Edition:

For Version 7.0:

• This fix will be embedded into IBM WebSphere Application Server Hypervisor Edition version 7.0.0.21 (projected to be available Jan 2012)
• For versions prior to 7.0.0.21, please follow the directions for 'IBM HTTP Server Versions 7.0 and 7.0.0.19'

For Version 6.1:

• This fix will be embedded into IBM WebSphere Application Server Hypervisor Edition version 6.1.0.41 (projected to be available Nov 2011)
• For versions prior to 6.1.0.41, please follow the directions for 'IBM HTTP Server Versions 6.1 and 6.1.0.39'

Note: Since it takes several weeks after a Fix Pack is released before a refreshed WebSphere Application Server Hypervisor Edition virtual image becomes available, customers may choose to apply the IBM HTTP Server Fix Pack or Interim Fix listed in the Long-Term Solution section "For IBM HTTP Server for distributed operating systems" directly within their running instances rather than waiting for the updated virtual image.