IBM Support

Security Bulletin: A security vulnerability has been identified in Tivoli Integrated Portal shipped with IBM Tivoli Storage Manager FastBack for Workstations (CVE-2017-1121)

Created by Erik Wilkinson on
Published URL:
https://www.ibm.com/support/pages/node/292067
292067

Security Bulletin


Summary

Inside the Tivoli Integrated Portal there is a potential cross-site scripting vulnerability in the Admin Console of WebSphere Application Server in the underlying eWAS

Vulnerability Details

Please consult the Security Bulletin: Potential Cross-site scripting vulnerability in WebSphere Application Server (CVE-2017-1121) for vulnerability details and information about fixes.

Affected Products and Versions

FastBack for Workstations Central Administration Console (CAC) 6.3.

Remediation/Fixes

FastBack for Workstations CAC 6.3
The fix for FastBack for Workstations CAC 6.3 will be to update the embedded eWAS included with the Tivoli Integrated Portal to 7.0.0.41 and then apply the WAS interim fix pack PI73367.

Update embedded eWAS to 7.0.0.41
To update the embedded eWAS included with the Tivoli Integrated Portal to 7.0.0.41, click on the following link:
http://www.ibm.com/support/docview.wss?uid=swg21981056
and then download 7.0.0-WS-WASEmbeded-WinX32-FP0000041.pak

To update the embedded eWAS, do the following:

  1. If not already at the CAC 6.3.1.1 version upgrade to this version.
  2. Stop the Tivoli Service: Tivoli Integrated Portal - V2.2_TIPProfile_Port_16310
  3. Using the Update Installer application (update.exe) found in the Tivoli Integrated Portal installation directory (default location: C:\IBM\Tivoli\Tipv2_fbws\WebSphereUpdateInstallerV7) apply the 7.0.0-WS-WASEmbeded-WinX32-FP0000041.pak file downloaded earlier
Apply WAS interim fix packPI73367
In order to obtain the PI73367 fix, refer to the WAS security bulletin:
http://www-01.ibm.com/support/docview.wss?uid=swg24043318
Click on the Fix Central (FC) download link for 7.0.0.29-WS-WAS-IFPI73367. Once downloaded, there will be a Readme.txt file and a 7.0.0.29-WS-WAS-IFPI73367.pak file.

To apply the interim fix after having upgraded to eWAS 7.0.0.41, do the following:
  1. Using the Update Installer application (update.exe) found in the Tivoli Integrated Portal installation directory (default location: C:\IBM\Tivoli\Tipv2_fbws\WebSphereUpdateInstallerV7) apply the 7.0.0.29-WS-WAS-IFPI73367.pak file downloaded earlier
  2. Restart the Tivoli Service or reboot the machine

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Complete CVSS v3 Guide
On-line Calculator v3

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Change History

24 February 2017: Original Version

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SS6PEB","label":"Tivoli Storage Manager FastBack for Workstations"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Component":"--","Platform":[{"code":"PF033","label":"Windows"}],"Version":"6.3","Edition":"All Editions","Line of Business":{"code":"LOB26","label":"Storage"}}]

Document Information

Modified date:
17 June 2018

UID

swg21998877

Page Feedback