IT47808: THIRD PARTY BINARIES ARE GETTING FLAGGED DURING SECURITY SCAN

APAR status

• Closed as Vendor Solution.

Error description

• Third party binaries available in the Storage Insights
  Data Collector  bin  folder are getting flagged as vulnerable
  during security scans.
  
  The binaries are not vulnerable but are unsigned and thus
  are flagged as vulnerable in scan reports.
  
  === Flagged Binaries ===
  
  netapp_cpdot.exe
  hitachi_ops.exe
  emc_unity.exe
  
  ==================
  

Local fix

• If you do not plan on adding or monitoring these 3rd party
  devices (such as NetApp, Hitachi, EMC) you can remove
  the flagged binaries from the Data Collector install path
  bin folder:  <DC_install_dir>\bin\
  

Problem summary

Problem conclusion

Temporary fix

Comments

• IBM has validated and submitted our binaries to third-party
  antivirus vendors with request to whitelist the binaries.
  
  Several have confirmed and updated their whitelists, but
  unfortunately not all vendors have provided confirmation.
  
  You may continue to encounter false-positive
  vulnerabilities from these vendors:
   ? Skyhigh (SWG)
   ? SentinelOne (Static ML)
   ? Fortinet
  
  
  If your antivirus software prevents the monitoring of some
  of your devices, such as Hitachi VSP, Dell EMC, NetApp,
  or Pure storage, add the related executable files for those
  devices to your allowlist.
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels