9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.148 Low
EPSS
Percentile
95.0%
This interim fix provides instructions on upgrading Apache Tomcat from v5.5.36 to v7.0.90 in IBM Platform Symphony 6.1.1 and from v6.0.43 to v8.5.32 in IBM Platform Symphony 7.1 Fix Pack 1 in order to address security vulnerability CVE-2018-8014 in Tomcat.
CVE-ID: CVE-2018-8014
Description: Apache Tomcat could provide weaker than expected security, caused by insecure default settings for the CORS filter. A remote attacker could exploit this vulnerability to launch further attacks on the system.
CVSS Base Score: 5.3
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/143411 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Platform Symphony 6.1.1
Platform Symphony 7.1 Fix Pack 1
Applicability
Operating systems: Linux2.6-glibc2.3-x86_64
Cluster type: Single grid cluster
Packages
Product | APAR | _Remediation/First Fix _ |
---|---|---|
IBM Platform Symphony 6.1.1 | P102656 |
sym6.1.1_lnx26-lib23-x64_build497567.tar.gz
IBM Platform Symphony 7.1 Fix Pack 1 | P102656 |
sym7.1_lnx26-lib23-x64_build497568.tar.gz
Apache Tomcat 7.0.90 | N/A |
Apache Tomcat 8.5.32 | N/A |
For a Platform Symphony 6.1.1 cluster, you can optionally take advantage of a security service pack. To apply this interim fix along with the security service pack:
Install the service pack (sym-6.1.1-spk-Security-build227853).
Apply this interim fix (sym6.1.1_lnx26-lib23-x64_build497567.tar.gz) to your cluster.
If you do not want to apply the 6.1.1 security service pack, proceed to directly apply this interim fix to your cluster.
Log on to the primary management host as the cluster administrator and stop the WEBGUI service:
> egosh user logon -u Admin -x Admin
> source $EGO_TOP/cshrc.platform
> egosh service stop WEBGUI
Log on to each management host in the cluster and back up the following files for recovery purposes:
$EGO_TOP/gui/1.2.8/tomcat/
$EGO_CONFDIR/…/…/gui/conf/catalina.policy
$EGO_CONFDIR/…/…/gui/conf/catalina.properties
$EGO_CONFDIR/…/…/gui/conf/server.xml
$EGO_TOP/gui/ego/1.2.8/platform/WEB-INF/web.xml
$EGO_TOP/gui/is/6.1.1/isgui/WEB-INF/web.xml
$EGO_TOP/gui/perf/1.2.8/perfgui/WEB-INF/web.xml
$EGO_TOP/gui/soam/6.1.1/symgui/WEB-INF/web.xml
$EGO_TOP/gui/soam/6.1.1/soamgui/WEB-INF/web.xml
On each management host, copy the apache-tomcat-7.0.90.tar.gz package to a temporary folder and decompress the file:
> cp apache-tomcat-7.0.90.tar.gz /tmp
> tar zxvf apache-tomcat-7.0.90.tar.gz
> rm -rf apache-tomcat-7.0.90/conf/
> rm -rf apache-tomcat-7.0.90/work/
> rm -rf apache-tomcat-7.0.90/logs/
Copy the Tomcat folder:
> rm -rf $EGO_TOP/gui/1.2.8/tomcat
> cp -rf apache-tomcat-7.0.90 $EGO_TOP/gui/1.2.8/tomcat
Copy the sym6.1.1_lnx26-lib23-x64_build497567.tar.gz package and decompress it:
> tar zxfo sym6.1.1_lnx26-lib23-x64_build497567.tar.gz -C $EGO_TOP
If you ran the “egoconfig mghostshared_dir” command during installation to set up a shared location for configuration files, ensure that the configuration file is changed in the shared directory:
> cp $EGO_TOP/gui/conf/catalina.policy $EGO_CONFDIR/…/…/gui/conf/catalina.policy
> cp $EGO_TOP/gui/conf/catalina.properties $EGO_CONFDIR/…/…/gui/conf/catalina.properties
> cp $EGO_TOP/gui/conf/server.xml $EGO_CONFDIR/…/…/gui/conf/server.xml
If you modified the $EGO_CONFDIR/…/…/gui/conf/server.xml configuration file for details such as the GUI service port, manually redo those changes.
Edit the web.xml files to add the following configuration:
1. Edit each of the following files:
$EGO_TOP/gui/ego/1.2.8/platform/WEB-INF/web.xml
$EGO_TOP/gui/is/6.1.1/isgui/WEB-INF/web.xml
$EGO_TOP/gui/perf/1.2.8/perfgui/WEB-INF/web.xml
$EGO_TOP/gui/soam/6.1.1/symgui/WEB-INF/web.xml
$EGO_TOP/gui/soam/6.1.1/soamgui/WEB-INF/web.xml
2. Find the “<servlet-name>dwr-invoker</servlet-name>” line in the “</servlet>” section and add the following configuration:
<init-param>
<param-name>crossDomainSessionSecurity</param-name>
<param-value>false</param-value>
</init-param>
For example:
<servlet>
<servlet-name>dwr-invoker</servlet-name>
<servlet-class>org.directwebremoting.servlet.DwrServlet</servlet-class>
<init-param>
<param-name>debug</param-name>
<param-value>true</param-value>
</init-param>
<init-param> ** <param-name>crossDomainSessionSecurity</param-name>** <param-value>false</param-value> ** </init-param**>
</servlet>
On each management host, delete all subdirectories and files in the gui/work directory:
> rm -rf $EGO_TOP/gui/work/*
On all client hosts, open your web browser and clear the browser cache.
Start the WEBGUI service:
> source $EGO_TOP/cshrc.platform
> egosh service start WEBGUI
In the $EGO_TOP/gui/logs/catalina.out file, check whether the GUI version indicates version 7.0.90:
INFO: Server version: Apache Tomcat/7.0.90
Follow the instructions in this section to uninstall this update in your cluster, if required.
Log on to the primary management host as the cluster administrator and stop the WEBGUI service:
> egosh user logon -u Admin -X Admin
> source $EGO_TOP/cshrc.platform
> egosh service stop WEBGUI
On each management host, restore the backup files:
1. Remove the Tomcat folder, which was introduced by this interim fix:
> rm -rf $EGO_TOP/gui/1.2.8/tomcat
2. Restore the following folders and files from your backup:
$EGO_TOP/gui/1.2.8/tomcat/
$EGO_CONFDIR/…/…/gui/conf/catalina.policy
$EGO_CONFDIR/…/…/gui/conf/catalina.properties
$EGO_CONFDIR/…/…/gui/conf/server.xml
$EGO_TOP/gui/ego/1.2.8/platform/WEB-INF/web.xml
$EGO_TOP/gui/is/6.1.1/isgui/WEB-INF/web.xml
$EGO_TOP/gui/perf/1.2.8/perfgui/WEB-INF/web.xml
$EGO_TOP/gui/soam/6.1.1/symgui/WEB-INF/web.xml
$EGO_TOP/gui/soam/6.1.1/soamgui/WEB-INF/web.xml
Delete all subdirectories and files in the following directory:
> rm -rf $EGO_TOP/gui/work/*
On all client hosts, open your web browser and clear the browser cache.
Start the WEBGUI service:
> source $EGO_TOP/cshrc.platform
> egosh service start WEBGUI
Installation
Log on to the primary management host as the cluster administrator and stop the WEBGUI service:
> egosh user logon -u Admin -x Admin
> source $EGO_TOP/cshrc.platform
> egosh service stop WEBGUI
Log on to each management host in the cluster and back up the following files for recovery purposes:
$EGO_TOP/gui/3.1/tomcat/
$EGO_CONFDIR/…/…/gui/conf/catalina.policy
$EGO_CONFDIR/…/…/gui/conf/catalina.properties
$EGO_CONFDIR/…/…/gui/conf/server.xml$EGO_TOP/gui/ego/3.1/platform/WEB-INF/web.xml
$EGO_TOP/gui/is/7.1/isgui/WEB-INF/web.xml
$EGO_TOP/gui/perf/3.1/perfgui/WEB-INF/web.xml
$EGO_TOP/gui/soam/7.1/soamgui/WEB-INF/web.xml
$EGO_TOP/gui/soam/7.1/symgui/WEB-INF/web.xml
Copy the apache-tomcat-8.5.32.tar.gz package to a temporary folder and decompress the file:
> cp apache-tomcat-8.5.32.tar.gz /tmp
> tar zxvf apache-tomcat-8.5.32.tar.gz
> rm -rf apache-tomcat-8.5.32/conf/
> rm -rf apache-tomcat-8.5.32/work/
> rm -rf apache-tomcat-8.5.32/logs/
Copy the Tomcat folder:
> rm -rf $EGO_TOP/gui/3.1/tomcat
> cp -rf apache-tomcat-8.5.32 $EGO_TOP/gui/3.1/tomcat
Copy the sym7.1_lnx26-lib23-x64_build497568.tar.gz package and decompress it:
> tar zxfo sym7.1_lnx26-lib23-x64_build497568.tar.gz -C $EGO_TOP
If you ran the “egoconfig mghostshared_dir” command during installation to set up a shared location for configuration files, ensure that the configuration file is changed in the shared directory:
> cp $EGO_TOP/gui/conf/catalina.policy $EGO_CONFDIR/…/…/gui/conf/catalina.policy
> cp $EGO_TOP/gui/conf/catalina.properties $EGO_CONFDIR/…/…/gui/conf/catalina.properties
> cp $EGO_TOP/gui/conf/server.xml $EGO_CONFDIR/…/…/gui/conf/server.xml
If you modified the $EGO_CONFDIR/…/…/gui/conf/server.xml configuration file for details such as the GUI service port, manually redo those changes.
Edit the web.xml files to add the following configuration:
1. Edit each of the following files:
$EGO_TOP/gui/ego/3.1/platform/WEB-INF/web.xml
$EGO_TOP/gui/is/7.1/isgui/WEB-INF/web.xml
$EGO_TOP/gui/perf/3.1/perfgui/WEB-INF/web.xml
$EGO_TOP/gui/soam/7.1/symgui/WEB-INF/web.xml
$EGO_TOP/gui/soam/7.1/soamgui/WEB-INF/web.xml
2. Find the “<servlet-name>dwr-invoker</servlet-name>” line in the “</servlet>” section and add the following configuration:
<init-param>
<param-name>crossDomainSessionSecurity</param-name>
<param-value>false</param-value>
</init-param>
For example:
<servlet>
<servlet-name>dwr-invoker</servlet-name>
<servlet-class>org.directwebremoting.servlet.DwrServlet</servlet-class>
<init-param>
<param-name>debug</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>crossDomainSessionSecurity</param-name>
<param-value>false</param-value>
</init-param>
</servlet>
On each management host, delete all subdirectories and files in the following directory:
> rm -rf $EGO_TOP/gui/work/*
On all client hosts, open your web browser and clear the browser cache.
Start the WEBGUI service:
> source $EGO_TOP/cshrc.platform
> egosh service start WEBGUI
In the $EGO_TOP/gui/logs/catalina.out file, check whether the GUI version indicates version 8.5.32:
INFO: Server version: Apache Tomcat/8.5.32
Follow the instructions in this section to uninstall this update in your cluster, if required.
Log on to the primary management host as the cluster administrator and stop the WEBGUI service:
> egosh user logon -u Admin -x Admin
> source $EGO_TOP/cshrc.platform
> egosh service stop WEBGUI
On each management host, restore the backup files:
1. Remove the Tomcat folder, which was introduced by this interim fix:
> rm -rf $EGO_TOP/gui/3.1/tomcat
2. Restore the following folders and files from your backup:
$EGO_TOP/gui/3.1/tomcat
$EGO_CONFDIR/…/…/gui/conf/catalina.policy
$EGO_CONFDIR/…/…/gui/conf/catalina.properties
$EGO_CONFDIR/…/…/gui/conf/server.xml
$EGO_TOP/gui/ego/3.1/platform/WEB-INF/web.xml
$EGO_TOP/gui/is/7.1/isgui/WEB-INF/web.xml
$EGO_TOP/gui/perf/3.1/perfgui/WEB-INF/web.xml
$EGO_TOP/gui/soam/7.1/soamgui/WEB-INF/web.xml
$EGO_TOP/gui/soam/7.1/symgui/WEB-INF/web.xml
Delete all subdirectories and files in the following directory:
> rm -rf $EGO_TOP/gui/work/*
On all client hosts, open your web browser and clear the browser cache.
Start the WEBGUI service:
> source $EGO_TOP/cshrc.platform
> egosh service start WEBGUI
None
CPE | Name | Operator | Version |
---|---|---|---|
platform symphony | eq | 6.1.1 | |
platform symphony | eq | 7.1 | |
platform symphony | eq | 1 |
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.148 Low
EPSS
Percentile
95.0%