Security Bulletin: A security vulnerability has been identified in Tivoli Integrated Portal shipped with IBM Tivoli Storage Manager FastBack for Workstations (CVE-2017-1121)

Summary

Inside the Tivoli Integrated Portal there is a potential cross-site scripting vulnerability in the Admin Console of WebSphere Application Server in the underlying eWAS

Vulnerability Details

Please consult the Security Bulletin: Potential Cross-site scripting vulnerability in WebSphere Application Server (CVE-2017-1121) for vulnerability details and information about fixes.

Affected Products and Versions

FastBack for Workstations Central Administration Console (CAC) 6.3.

Remediation/Fixes

FastBack for Workstations CAC 6.3
The fix for FastBack for Workstations CAC 6.3 will be to update the embedded eWAS included with the Tivoli Integrated Portal to 7.0.0.41 and then apply the WAS interim fix pack PI73367.

Update embedded eWAS to 7.0.0.41
To update the embedded eWAS included with the Tivoli Integrated Portal to 7.0.0.41, click on the following link:
http://www.ibm.com/support/docview.wss?uid=swg21981056
and then download 7.0.0-WS-WASEmbeded-WinX32-FP0000041.pak

To update the embedded eWAS, do the following:

1. If not already at the CAC 6.3.1.1 version upgrade to this version.
2. Stop the Tivoli Service: Tivoli Integrated Portal - V2.2_TIPProfile_Port_16310
3. Using the Update Installer application (update.exe) found in the Tivoli Integrated Portal installation directory (default location: C:\IBM\Tivoli\Tipv2_fbws\WebSphereUpdateInstallerV7) apply the 7.0.0-WS-WASEmbeded-WinX32-FP0000041.pak file downloaded earlier

Apply WAS interim fix pack****PI73367
In order to obtain the PI73367 fix, refer to the WAS security bulletin:_
_http://www-01.ibm.com/support/docview.wss?uid=swg24043318
Click on the Fix Central (FC) download link for 7.0.0.29-WS-WAS-IFPI73367. Once downloaded, there will be a Readme.txt file and a 7.0.0.29-WS-WAS-IFPI73367.pak file.

To apply the interim fix after having upgraded to eWAS 7.0.0.41, do the following:

1. Using the Update Installer application (update.exe) found in the Tivoli Integrated Portal installation directory (default location: C:\IBM\Tivoli\Tipv2_fbws\WebSphereUpdateInstallerV7) apply the 7.0.0.29-WS-WAS-IFPI73367.pak file downloaded earlier
2. Restart the Tivoli Service or reboot the machine

Workarounds and Mitigations

None