Security Bulletin: Vulnerability in Apache Tomcat affects IBM Platform Symphony

Remediation/Fixes

Applicability
Operating systems: Linux-x86_64
Cluster type: Single grid cluster
Packages

For Platform Symphony 7.1 Fix Pack 1

Installation

1. Log on to the primary host as the cluster administrator and stop the WEBGUI service:
   > egosh user logon -u Admin -x Admin
   > source $EGO_TOP/cshrc.platform
   > egosh service stop WEBGUI

2. Log on to each management host in the cluster and back up the following files for recovery purposes:
   $EGO_TOP/gui/3.1/tomcat/
   $EGO_CONFDIR/../../gui/conf/catalina.policy
   $EGO_CONFDIR/../../gui/conf/catalina.properties
   $EGO_CONFDIR/../../gui/conf/server.xml$EGO_TOP/gui/ego/3.1/platform/WEB-INF/web.xml
   $EGO_TOP/gui/is/7.1/isgui/WEB-INF/web.xml
   $EGO_TOP/gui/perf/3.1/perfgui/WEB-INF/web.xml
   $EGO_TOP/gui/soam/7.1/soamgui/WEB-INF/web.xml
   $EGO_TOP/gui/soam/7.1/symgui/WEB-INF/web.xml

3. Copy the apache-tomcat-8.5.37.tar.gz package to a temporary folder and decompress the file:
   > cp apache-tomcat-8.5.37.tar.gz /tmp
   > tar zxvf apache-tomcat-8.5.37.tar.gz
   > rm -rf apache-tomcat-8.5.37/conf/
   > rm -rf apache-tomcat-8.5.37/work/
   > rm -rf apache-tomcat-8.5.37/logs/

4. Copy the Tomcat folder:
   > rm -rf $EGO_TOP/gui/3.1/tomcat
   > cp -rf apache-tomcat-8.5.37 $EGO_TOP/gui/3.1/tomcat

5. Copy the sym7.1_lnx26-lib23-x64_build509541.tar.gz package and decompress it:
   > tar zxfo sym7.1_lnx26-lib23-x64_build509541.tar.gz -C $EGO_TOP

6. If you ran the “egoconfig mghost shared_dir” command during installation to set up a shared location for configuration files, ensure that the configuration file is changed in the shared directory:
   > cp $EGO_TOP/gui/conf/catalina.policy $EGO_CONFDIR/../../gui/conf/catalina.policy
   > cp $EGO_TOP/gui/conf/catalina.properties $EGO_CONFDIR/../../gui/conf/catalina.properties
   > cp $EGO_TOP/gui/conf/server.xml $EGO_CONFDIR/../../gui/conf/server.xml

7. If you modified the $EGO_CONFDIR/../../gui/conf/server.xml configuration file for details such as the GUI service port, manually redo those changes.

8. Edit the web.xml files to add the following configuration:

   1. Edit each of the following files:
      $EGO_TOP/gui/ego/3.1/platform/WEB-INF/web.xml
      $EGO_TOP/gui/is/7.1/isgui/WEB-INF/web.xml
      $EGO_TOP/gui/perf/3.1/perfgui/WEB-INF/web.xml
      $EGO_TOP/gui/soam/7.1/symgui/WEB-INF/web.xml
      $EGO_TOP/gui/soam/7.1/soamgui/WEB-INF/web.xml

   2. Find the “<servlet-name>dwr-invoker</servlet-name>” line in the “</servlet>” section and add the following configuration:
      <init-param>
              <param-name>crossDomainSessionSecurity</param-name>
             <param-value>false</param-value>
      </init-param>
      For example:
      <servlet>
          <servlet-name>dwr-invoker</servlet-name>
          <servlet-class>org.directwebremoting.servlet.DwrServlet</servlet-class>
                              <init-param>
                       <param-name>debug</param-name>
                   <param-value>true</param-value>
                 </init-param>
                <init-param>
                   <param-name>crossDomainSessionSecurity</param-name>
                   <param-value>false</param-value>
                </init-param>
      </servlet>

9. On each management host, delete all subdirectories and files in the following directory:
   > rm -rf $EGO_TOP/gui/work/*

10. On all client hosts, open your web browser and clear the browser cache.

11. Start the WEBGUI service:
    > source $EGO_TOP/cshrc.platform
    > egosh service start WEBGUI

12. In the $EGO_TOP/gui/logs/catalina.out file, check whether the GUI version indicates version 8.5.37:
    INFO: Server version:        Apache Tomcat/8.5.37

Uninstallation

Follow the instructions in this section to uninstall this update in your cluster, if required.

1. Log on to the primary host as the cluster administrator and stop the WEBGUI service:
   > egosh user logon -u Admin -x Admin
   > source $EGO_TOP/cshrc.platform
   > egosh service stop WEBGUI

2. On each management host, restore the backup files:

   1. Remove the Tomcat folder, which was introduced by this interim fix:
      > rm -rf $EGO_TOP/gui/3.1/tomcat

   2. Restore the following folders and files from your backup:
      $EGO_TOP/gui/3.1/tomcat
      $EGO_CONFDIR/../../gui/conf/catalina.policy
      $EGO_CONFDIR/../../gui/conf/catalina.properties
      $EGO_CONFDIR/../../gui/conf/server.xml
      $EGO_TOP/gui/ego/3.1/platform/WEB-INF/web.xml
      $EGO_TOP/gui/is/7.1/isgui/WEB-INF/web.xml
      $EGO_TOP/gui/perf/3.1/perfgui/WEB-INF/web.xml
      $EGO_TOP/gui/soam/7.1/soamgui/WEB-INF/web.xml
      $EGO_TOP/gui/soam/7.1/symgui/WEB-INF/web.xml

3. Delete all subdirectories and files in the following directory:
   > rm -rf $EGO_TOP/gui/work/*

4. On all client hosts, open your web browser and clear the browser cache.

5. Start the WEBGUI service:
   > source $EGO_TOP/cshrc.platform
   > egosh service start WEBGUI