IBM Support

IC96157: A "POWERED BY JETTY" LINK IS DISPLAYED WHEN WRONG URL IS ENTERED IN MYFILEGATEWAY URI - POTENTIAL SECURITY ISSUE

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • After deploying the myfilegateway.war in a new HTTP Server
    adapter, attempt to log into the URI, however with a typo in the
    URL.
    For example, if the URI is:
    http://<yourhostname>:<port>/myfilegateway
    
    Type in the URL:
    http://<yourhostname>:<port>/myfile
    
    Notice the page displayed has the following:
    HTTP ERROR: 404
    NOT_FOUND
    RequestURI=/mfg
    Powered by jetty://
    
    The "Powered by Jetty" is a link and the customer considers
    this a security issue.
    

Local fix

  • STRRTC - 392622
    SB /SB
    
    Circumvention:
    If using a firewall, allow a firewall to only access specific
    URLs. Then, if a bogus URL is specified, the access will
    be denied at the firewall level.
    

Problem summary

  • Users Affected:
    All My File Gateway users
    
    Problem Description:
    A link (Powered by Jetty) is displayed when the wrong URL is
    typed using myfilegateway. Customer considers this a security
    issue and wants the link removed.
    
    Platforms Affected:
    All
    

Problem conclusion

  • Resolution Summary:
    A new error handler was created to override the default and
    ensure that the link is removed from the error page when the
    wrong URI is typed into myfilegateway.
    
    Delivered In:
    5020500_3
    

Temporary fix

Comments

APAR Information

  • APAR number

    IC96157

  • Reported component name

    STR B2B INTEGRA

  • Reported component ID

    5725D0600

  • Reported release

    524

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt

  • Submitted date

    2013-09-23

  • Closed date

    2015-03-04

  • Last modified date

    2015-03-25

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    STR B2B INTEGRA

  • Fixed component ID

    5725D0600

Applicable component levels

  • R525 PSY

       UP

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SS3JSW","label":"IBM Sterling B2B Integrator"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"5.2.4","Edition":"","Line of Business":{"code":"LOB02","label":"AI Applications"}}]

Document Information

Modified date:
25 March 2015