IBM Support

PM34841; Potential security exposure with WebSphere Application Server

Download


Abstract

Web Services requests (either JAX-RPC or JAX-WS) containing data encrypted by WS-Security can be decrypted by way of a decryption attack.

Download Description

PM34841 resolves the following problem:

ERROR DESCRIPTION:
Web Services requests (either JAX-RPC or JAX-WS) containing data encrypted by WS-Security can be decrypted by way of a decryption attack.

LOCAL FIX:

PROBLEM SUMMARY

USERS AFFECTED:
All users of IBM WebSphere Application Server using web services and WS-Security XML excryption

PROBLEM DESCRIPTION:
Potential security exposure with IBM WebSphere Application Server with Web Services using XML Encryption

If Web Service requests (either JAX-WS or JAX-RPC) containing encrypted data can be intercepted, then the encrypted information can be decrypted using an attack based on XML Encryption. All versions of JAX-RPC and JAX-WS are vulnerable.

RECOMMENDATION:
Install a fix pack which contains this APAR and set the specified JVM property.

PROBLEM CONCLUSION:


Applying Interim Fix APAR PM34841 or a Fix Pack containing one of these APARs, and enabling the update by setting a JVM custom property, resolves this issue. For IBM WebSphere Application Server Versions after 6.1.0.37 or 7.0.0.15, an update does not need to be installed, but it must be enabled by setting a custom JVM property, which resolves this issue.

When the update is enabled by setting the JVM custom property, detailed information may be removed from any SOAPFault generated by the Web Service runtimes. Note that the update is not enabled by default in order to maintain application compatibility with respect to SOAPFaults.

To enable the update, the following JVM custom property must be set after the update is installed: webservices.unify.faults=true . This property can be set using the administrative console as described in the Information Center article "Java virtual machine custom properties"


The fix for this APAR is currently targeted for inclusion in fix pack 6.1.0.39 and 7.0.0.17. Please refer to the Recommended Updates

Page for delivery information:
http://www.ibm.com/support/docview.wss?uid=swg27004980

Prerequisites

Download the UpdateInstaller below to install this fix.

[{"PRLabel":"UpdateInstaller","PRLang":"US English","PRSize":"7250000","PRPlat":{"label":"AIX","code":"PF002"},"PRURL":"http://www.ibm.com/support/docview.wss?uid=swg21205991"}]

Installation Instructions

Please review the readme.txt for detailed installation instructions.

[{"INLabel":"Readme","INLang":"US English","INSize":"8237","INURL":"ftp://public.dhe.ibm.com/software/websphere/appserv/support/fixes/PM34841/readme.txt"}]
On
[{"DNLabel":"6.0.2.33-WS-WAS-IFPM34841","DNDate":"4/6/2011","DNLang":"US English","DNSize":"16568","DNPlat":{"label":"AIX","code":"PF002"},"DNURL":"http://www.ibm.com/support/fixcentral/quickorder?fixids=6.0.2.33-WS-WAS-IFPM34841&product=ibm%2FWebSphere%2FWebSphere+Application+Server&source=dbluesearch","DNURL_FTP":"ftp://public.dhe.ibm.com/software/websphere/appserv/support/fixes/PM34841/6.0.2.33-WS-WAS-IFPM34841.pak","DDURL":"http://public.dhe.ibm.com:7618;sw_websphere;appserv/support/fixes/PM34841/6.0.2.33-WS-WAS-IFPM34841.pak"},{"DNLabel":"6.1.0.29-WS-WAS-IFPM34841","DNDate":"4/6/2011","DNLang":"US English","DNSize":"29667","DNPlat":{"label":"AIX","code":"PF002"},"DNURL":"http://www.ibm.com/support/fixcentral/quickorder?fixids=6.1.0.29-WS-WAS-IFPM34841&product=ibm%2FWebSphere%2FWebSphere+Application+Server&source=dbluesearch","DNURL_FTP":"ftp://public.dhe.ibm.com/software/websphere/appserv/support/fixes/PM34841/6.1.0.29-WS-WAS-IFPM34841.pak","DDURL":"http://public.dhe.ibm.com:7618;sw_websphere;appserv/support/fixes/PM34841/6.1.0.29-WS-WAS-IFPM34841.pak"},{"DNLabel":"7.0.0.11-WS-WAS-IFPM34841","DNDate":"4/6/2011","DNLang":"US English","DNSize":"361612","DNPlat":{"label":"AIX","code":"PF002"},"DNURL":"http://www.ibm.com/support/fixcentral/quickorder?fixids=7.0.0.11-WS-WAS-IFPM34841&product=ibm%2FWebSphere%2FWebSphere+Application+Server&source=dbluesearch","DNURL_FTP":"ftp://public.dhe.ibm.com/software/websphere/appserv/support/fixes/PM34841/7.0.0.11-WS-WAS-IFPM34841.pak","DDURL":"http://public.dhe.ibm.com:7618;sw_websphere;appserv/support/fixes/PM34841/7.0.0.11-WS-WAS-IFPM34841.pak"},{"DNLabel":"7.0.0.13-WS-WAS-IFPM34841","DNDate":"4/15/2011","DNLang":"US English","DNSize":"194434","DNPlat":{"label":"AIX","code":"PF002"},"DNURL":"http://www.ibm.com/support/fixcentral/quickorder?fixids=7.0.0.13-WS-WAS-IFPM34841&product=ibm%2FWebSphere%2FWebSphere+Application+Server&source=dbluesearch","DNURL_FTP":"ftp://public.dhe.ibm.com/software/websphere/appserv/support/fixes/PM34841/7.0.0.13-WS-WAS-IFPM34841.pak","DDURL":"http://public.dhe.ibm.com:7618;sw_websphere;appserv/support/fixes/PM34841/7.0.0.13-WS-WAS-IFPM34841.pak"},{"DNLabel":"7.0.0.15-WS-WAS-IFPM34841","DNDate":"4/6/2011","DNLang":"US English","DNSize":"74986","DNPlat":{"label":"AIX","code":"PF002"},"DNURL":"http://www.ibm.com/support/fixcentral/quickorder?fixids=7.0.0.15-WS-WAS-IFPM34841&product=ibm%2FWebSphere%2FWebSphere+Application+Server&source=dbluesearch","DNURL_FTP":"ftp://public.dhe.ibm.com/software/websphere/appserv/support/fixes/PM34841/7.0.0.15-WS-WAS-IFPM34841.pak","DDURL":"http://public.dhe.ibm.com:7618;sw_websphere;appserv/support/fixes/PM34841/7.0.0.15-WS-WAS-IFPM34841.pak"}]

Technical Support

Contact IBM Support using SR (http://www.ibm.com/software/support/probsub.html), visit the WebSphere Application Server support web site (http://www.ibm.com/support/entry/portal/Overview/Software/WebSphere/WebSphere_Application_Server), or contact 1-800-IBM-SERV (U.S. only).

[{"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Web Services (for example: SOAP or UDDI or WSGW or WSIF)","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF012","label":"IBM i"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"7.0.0.15;7.0.0.13;7.0.0.11;6.1.0.37;6.1.0.35;6.1.0.33;6.1.0.31;6.1.0.29;6.0.2.43;6.0.2.41;6.0.2.39;6.0.2.37;6.0.2.35;6.0.2.33","Edition":"Base;Network Deployment","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
15 June 2018

UID

swg24029632

Page Feedback