PK61315; Attribute in SOAP security header may cause security exposure

Download Description

PK61315 resolves the following problem:

ERROR DESCRIPTION:
There is a serious security exposure with the handling of a certain attribute within the Web services SOAP security header which may make it possible for an intruder to compromise the security of the system.

LOCAL FIX:
There is no workaround possible within IBM WebSphere Application Server itself if WS-Security enabled Web services applications are in use. However, if Application Server is not processing the security header within SOAP messages directly, this risk can be prevented. For example using DataPower to prevent direct access to the Application Server Web services security runtime prevents this vulnerability.

PROBLEM SUMMARY

USERS AFFECTED:
IBM WebSphere Application Server Version 6 administrators of WS-Security enabled Web services providers. IBM WebSphere Application Server Version 6.1 Feature Pack for Web Services V6.1 is also affected. Web services applications configured to use only transport layer security (for example HTTP basic authentication or SSL certificates) are not affected. This problem occurs on IBM WebSphere Application Server versions 6.0 through 6.0.2.28, and 6.1 through 6.1.0.16. The problem does not occur on versions 4.0, 5.0, 5.1, 6.0.2.29 and later, and 6.1.0.17 and later.

PROBLEM DESCRIPTION:
There is a serious security exposure with the handling of a certain attribute within the Web services SOAP security header which may make it possible for an intruder to compromise the security of the system. Urgent application of this APAR is recommended.

RECOMMENDATION:
Apply APAR PK61315 or a Fix Pack containing this APAR.

PROBLEM CONCLUSION:
The handling of the attribute has been improved to remove this possible exposure. Applying APAR PK61315, or a Fix Pack containing this APAR, resolves this issue.

The fix for this APAR is currently targeted for inclusion in Fix Pack 6.0.2.29 and 6.1.0.17.

There are seven Interim Fixes that can be downloded from this page. There are two readmes that describe the IBM WebSphere Application Server levels to which each of these Interim Fixes apply; Readme describes the V6.1 Interim Fixes and Readme602 describes the V6.0.2 Interim Fixes.

If you have a level of IBM WebSphere Application Server V6.1 or V6.0 that is less than 6.0.2.29 or 6.1.0.17 and that is not represented by an Interim Fix on this page, it does not mean that APAR PK61315 does not occur on your level of WebSphere Application Server. This only means that an Interim Fix has not been created for that level. In order for APAR PK61315 to be applied to such levels, they must be either moved up to 6.0.2.29, 6.1.0.17, or one of the Fix Packs for which there is an Interim Fix available.

For example, if you are using 6.0.2.17 and wish to install an interim fix for this APAR, you must upgrade to 6.0.2.19, then install the 6.0.2.19-WS-WAS-IFPK61315 interim fix that is referenced from this page.

Please refer to the Recommended Updates page for delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980