IBM Tivoli Composite Application Manager for Transactions Response Time 7.4 Interim Fix 21 README Tivoli Composite Application Manager for Transactions 7.4.0.1 7.4.0.1-TIV-CAMRT-IF0021 Readme

The information included in this document is published at product release time. For the latest updates on this release please refer to the on-line document: To download this update you must first login to IBM FixCentral. Once logged in, you may select from the individual download packages. HPUX and Solaris downloads are no longer provided.
http://www.ibm.com/eserver/support/fixes/

Below is a list of components, platforms, and file names that apply to this Readme file.

This upgrade for the Robotic Response Time agents , which is part of ITCAM for Transactions: Response Time, may be applied to the following base versions.

• 7.3.0.x - AIX, Windows, Linux
• 7.4.0.x - AIX, Windows, Linux

Notes:

1. Supported base versions include interim fixes applied to any of the above release levels.

This patch replaces the two JREs shipped with the Robotics Response Time (T6) agent, bringing them to the latest level. This remediates multiple security issues.

This patch is applicable for T6 agents:

• versions 7.4.0.x and 7.3.0.x
• Windows, AIX and Linux platforms.

The T6's JREs are only used when playing back Rational Performance Tester (RPT) scripts, thus not available on Solaris and HPUX (RPT playback is not supported on Solaris and HPUX).
7.4 agent needs to update java 80 JRE. 7.4 and 7.3 agents need to update both java60 and java 70 JREs. 7.2 and 7.1 agents only needs to update java60. These variations are noted in the installation steps below.
Any customisations done to the existing JREs needs to be preserved. Since these JREs are product specific (ie only used by the T6 agent), there should only be at most one customisation as instructed by IBM support; which is to enable strong encryption by updating the JRE's encryption policy (see technote in Related Material).
After the patch, the Java versions will be:

• Java 6.0 SR16 FP45
• Java 7.0 SR10 FP05
• Java 8.0 SR04 FP06

Related material:
Its a cumulative JAVA upgrade for JAVA PSIRT, any updates in the following releases will be included in this upgrade.

• 7.4.0.0 - IF0007
• 7.4.0.0 - IF0012
• 7.4.0.0 - IF0016
• 7.4.0.0 - IF0022
• 7.4.0.0 - IF0025
• 7.4.0.0 - IF0027
• 7.4.0.0 - IF0029
• 7.4.0.0 - IF0030
• 7.4.0.0 - IF0032
• 7.4.0.0 - IF0033
• 7.4.0.1 - IF0005
• 7.4.0.1 - IF0007
• 7.4.0.1 - IF0009
• 7.4.0.1 - IF0012
• 7.4.0.1 - IF0015
• 7.4.0.1 - IF0018

Oracle Critical Patch Update Advisory - April 2017 - details vulnerabilities addressed
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html#AppendixJAVA

Details on Strong Encryption keys
http://www-01.ibm.com/support/docview.wss?uid=swg22002169

Before Installing

Validate pre-existing java is older than ones delivered in this IFix.
The RRT Agent's javas are located in

• Windows:
  • java60: $ITMHOME\tmaitm6\java60
  • java70: $ITMHOME\tmaitm6\java70 - only in 7.3.0.1-LA2 and later
  • java80: $ITMHOME\tmaitm6\java80 - only in 7.4.0.1-IF8 and later
• Unix:
  • java60: $ITMHOME/tmaitm6/java60
  • java70: $ITMHOME/tmaitm6/java70 - only in 7.3.0.1-LA2 and later
  • java80: $ITMHOME/tmaitm6/java80 - only in 7.4.0.1-IF8 and later

Check their versions, for example
C:\ibm\itm\TMAITM6> .\java80\jre\bin\java.exe -version

java version "1.8.0"
Java(TM) SE Runtime Environment (build pwi3280sr4fp2-20170322_01(SR4 FP2))
IBM J9 VM (build 2.8, JRE 1.8.0 Windows 10 x86-32 20170314_340265 (JIT enabled, AOT enabled)
J9VM - R28_20170314_2309_B340265
JIT - tr.r14.java.green_20170314_134138
GC - R28_20170314_2309_B340265
J9CL - 20170314_340265)
JCL - 20170318_01 based on Oracle jdk8u121-b13

Installing

Notes

1. If you have updated the T6 jre to use strong encryption, you must migrate the policy files to the new JREs. The two files are:
   • \lib\security\local_policy.jar
   • \lib\security\US_export_policy.jar

See:
http://www-01.ibm.com/support/docview.wss?uid=swg21245273

• Back up existing java
  1. Stop the T6 agent
  2. Backup existing java jres, for example
     > c:
     > cd c:\ibm\itm\tmaitm6\
     > move java60 java60.old
     > move java70 java70.old - only in 7.3.0.1-LA2 and later. > move java80 java80.old - only in 7.4.0.1-IF8 and later.
• Replace the JREs
  1. Unzip/Untar the archive to the same directory, for example, after unarchiving your directory structure should be like:
     c:\IBM\ITM\TMAITM6>dir java*
     

     Volume in drive C has no label.
     Volume Serial Number is 44AB-01FC
     
     Directory of c:\IBM\ITM\TMAITM6
     
     29/05/2013 02:02 PM <DIR> java60
     12/03/2012 04:08 PM <DIR> java60.old
     29/05/2013 02:04 PM <DIR> java70
     13/02/2013 02:14 PM <DIR> java70.old
     28/08/2016 07:08 PM <DIR> java80
     28/08/2016 07:17 PM <DIR> java80.old
     

     0 File(s) 0 bytes
     4 Dir(s) 40,808,731,648 bytes free
     

     
     
• Validate the update JRE version/function
  1. Check version number of JRE 6.0, for example
     > c:
     > cd c:\ibm\itm\tmaitm6
     > java60\jre\bin\java.exe -version
     java version "1.6.0"
     Java(TM) SE Runtime Environment (build pwi3260sr16fp45-20170502_01(SR16 FP45))
     IBM J9 VM (build 2.4, JRE 1.6.0 IBM J9 2.4 Windows Server 2008 R2 x86-32 jvmwi3260sr16fp45-20170407_343279 (JIT enabled, AOT enabled)
     J9VM - 20170407_343279
     JIT - r9_20170407_343279
     GC - GA24_Java6_SR16_20170407_1127_B343279)
     JCL - 20170420_01
     
     > java70\jre\bin\java.exe -version
     java version "1.7.0"
     Java(TM) SE Runtime Environment (build pwi3270sr10fp5-20170421_01(SR10 FP5))
     IBM J9 VM (build 2.6, JRE 1.7.0 Windows Server 2008 R2 x86-32 20170407_343227 (JIT enabled, AOT enabled)
     J9VM - R26_Java726_SR10_20170407_0035_B343227
     JIT - r11_20170407_343227
     GC - R26_Java726_SR10_20170407_0035_B343227
     J9CL - 20170407_343227)
     JCL - 20170420_01 based on Oracle jdk7u141-b11
     
     > java80\jre\bin\java.exe -version
     java version "1.8.0"
     Java(TM) SE Runtime Environment (build pwi3280sr4fp6-20170518_02(SR4 FP6))
     IBM J9 VM (build 2.8, JRE 1.8.0 Windows Server 2008 R2 x86-32 20170516_348050 (J IT enabled, AOT enabled)
     J9VM - R28_20170516_1905_B348050
     JIT - tr.r14.java_20170516_348050
     GC - R28_20170516_1905_B348050
     J9CL - 20170516_348050)
     JCL - 20170516_01 based on Oracle jdk8u131-b11
     
• Restart Agent and ensure RPT Script playback works.
• (Optional) Delete the backup java runtimes.

The Secure Hash Algorithm 1 (SHA1) checksum of the images are as follows:

7.4.0.1-TIV-CAMRT-AIX-IF0021.tar - f43b6057a8e4f256b32e1a8c5a8ce380de2e228f
7.4.0.1-TIV-CAMRT-Linux-IF0021.tar - f2225bc5553f288d63e6ae21781a67b19c37ad42
7.4.0.1-TIV-CAMRT-Windows-IF0021.zip - 41b62eac04a51e13f47b691fbbb29bdb559d3c8a

A) APAR Content:
IV97197 PSIRT 8420 IBM SDK, Java Technology Edition Quarterly CPU - Apr 2017 - Includes Oracle Apr 2017 CPU

B) Additional Non APAR Defects:
N/A

C) Enhancements
N/A

Version	Date	Description of change
1.0	14 June 2017	Initial Version