Security Bulletin: Multiple vulnerabilities in Apache Solr affect IBM Rational ClearQuest (CVE-2013-6407, CVE-2013-6408)

Workarounds and Mitigations

The mitigation is to take the following steps:

1. Locate the file <CQFTS_Home>/<DBSet_UserDB>/Solr/solr/conf/solrconfig.xml
   
2. Find the following two XML blocks that read
   
<requestHandler name="/update/xslt"
startup="lazy"
class="solr.XsltUpdateRequestHandler"/>

   And
   
<requestHandler name="/analysis/document"
class="solr.DocumentAnalysisRequestHandler"
startup="lazy"/>

   
3. Either remove those two XML blocks or comment them out.
   If you wish to use comments to exclude these blocks, you may use code like this surrounding the blocks:
   
<!--
...commented out block lines...
-->

   
4. Locate the file <CQFTS_Home>/<DBSet_UserDB>/Solr/typeahead/conf/solrconfig.xml
   
5. Find the following two XML blocks that read
   
<requestHandler name="/update/xslt"
startup="lazy"
class="solr.XsltUpdateRequestHandler"/>

   And
   
<requestHandler name="/analysis/document"
class="solr.DocumentAnalysisRequestHandler"
startup="lazy"/>

   
6. Either remove those two XML blocks or comment them out.
   If you wish to use comments to exclude these blocks, you may use code like this surrounding the blocks:
   
<!--
...commented out block lines...
-->

   
7. Using cqtsadmin.pl script, run the commands --stop_fts_was_profile and --start_fts_was_profile as documented here https://www.ibm.com/support/knowledgecenter/en/SSSH5A_9.0.1/com.ibm.rational.clearquest.cli.doc/topics/r_cqtsadmin_pl.htm to restart Solr so the changes to the solrconfig.xml files take effect.