IT18965: AUTHENTICATION BYPASS USING HTTP VERB TAMPERING

Media_IM_5020603_2
iSeries_Media_5020603_2.zip
iSeries_Media_5020603_2.zip
Media_IM_5020603_2

APAR status

• Closed as program error.

Error description

• Using specific IBM Sterling B2B Integrator .js and .jsp scripts,
  it may be possible to escalate user privileges and gain
  administrative permissions over the web application.
  
  It is possible to gather sensitive information about the web
  application such as usernames, passwords, machine name and/or
  sensitive file locations.
  

Local fix

• STRRTC - 526361
  SB/SB
  Circumvention:
  
  1. Modify <Install_dir>/noapp/etc/webdefault.xml.in as follows.
      Replace the following content at the end of file
  
      <security-constraint>
      <web-resource-collection>
        <web-resource-name>Disable TRACE</web-resource-name>
        <url-pattern>/*</url-pattern>
        <http-method>TRACE</http-method>
      </web-resource-collection>
      <auth-constraint/>
    </security-constraint>
  
    <security-constraint>
      <web-resource-collection>
        <web-resource-name>Disable MOVE</web-resource-name>
        <url-pattern>/*</url-pattern>
        <http-method>MOVE</http-method>
      </web-resource-collection>
      <auth-constraint/>
    </security-constraint>
  
     <security-constraint>
      <web-resource-collection>
        <web-resource-name>Disable MOVE</web-resource-name>
        <url-pattern>/*</url-pattern>
        <http-method>MOVE</http-method>
      </web-resource-collection>
      <auth-constraint/>
    </security-constraint>
  
    <security-constraint>
      <web-resource-collection>
        <web-resource-name>Disable DELETE</web-resource-name>
        <url-pattern>/*</url-pattern>
        <http-method>DELETE</http-method>
      </web-resource-collection>
      <auth-constraint/>
    </security-constraint>
  
    <security-constraint>
      <web-resource-collection>
        <web-resource-name>Disable OPTIONS</web-resource-name>
        <url-pattern>/*</url-pattern>
        <http-method>OPTIONS</http-method>
      </web-resource-collection>
      <auth-constraint/>
    </security-constraint>
  
    with the following content.
  
    <security-constraint>
      <web-resource-collection>
          <web-resource-name>Allowed methods</web-resource-name>
          <url-pattern>/*</url-pattern>
          <http-method>GET</http-method>
          <http-method>POST</http-method>
          <http-method>HEADER</http-method>
      </web-resource-collection>
    </security-constraint>
  
    <security-constraint>
      <web-resource-collection>
          <web-resource-name>Restricted
  methods</web-resource-name>
          <url-pattern>/*</url-pattern>
      </web-resource-collection>
      <auth-constraint />
  </security-constraint>
  
  2. Change directory to <B2Bi Install_dir>/bin and run
  setupfiles.sh
  
  3.  Restart B2Bi
  

Problem summary

• Users Affected:
  All
  
  Problem Description:
  Authentication Bypass Using HTTP Verb Tampering.
  
  Platforms Affected:
  All
  

Problem conclusion

• Resolution Summary:
  A code fix is provided.
  
  Delivered In:
  5020603_2
  5020500_16
  5020601_8
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STR B2B INTEGRA

• Fixed component ID

  5725D0600

Applicable component levels

• R526 PSY

     UP