JR59280: Information Server WEB APPLICATION LOGIN PAGES HAS A CROSS FRAMESCRIPTING (XFS) VULNERABILITY

Download the mod pack for IBM InfoSphere Information Server 11.7.1.0 In-Place Upgrade

APAR status

• Closed as program error.

Error description

• System is vulnerable for the Cross-Frame Scripting (XFS) attack
  that combines malicious
  JavaScript with an iframe that loads a legitimate page in an
  effort to steal data from an unsuspecting user. This attack is
  usually only successful when combined with social engineering.
  The fix is to use the X-FRAME-OPTIONS response header value (set
  to value SAMEORIGIN or DENY) for the login windows.
  
  CVSS Base Score: 6.1
  CVSS Temporal Score: See
  https://exchange.xforce.ibmcloud.com/vulnerabilities/139360 for
  the current score
  CVSS Environmental Score*: Undefined
  CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
  
  APAR RECOMMENDATION:
  Please refer to the Security bulletin for remediation:
  http://www-01.ibm.com/support/docview.wss?uid=swg22014911
  

Local fix

• N/A
  

Problem summary

• *********************************************
  APAR Users Affected:
  *********************************************
  InfoSphere Information Governance Catalog users.
  
  *********************************************
  APAR Problem Description:
  *********************************************
  To fix the Login Pages from cross frame scripting (XFS)
  vulnarability. Cross-Frame Scripting (XFS) is an attack that
  combines malicious JavaScript with an iframe that loads a
  legitimate page in an effort to steal data from an unsuspecting
  user.
  
  *********************************************
  APAR Recommendation:
  *********************************************
  Refer to the Security bulletin for remediation:
  http://www-01.ibm.com/support/docview.wss?uid=swg22014911
  
  *********************************************
  

Problem conclusion

• Apply the fix for JR59280
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IS GOVCATLOG

• Fixed component ID

  5724Q36GC

Applicable component levels

• RB31 PSY

     UP

• RB50 PSY

     UP

• RB70 PSY

     UP