Security Bulletin: A security vulnerability has been identified in Tivoli Integrated Portal shipped with IBM Tivoli Storage Manager FastBack for Workstations (CVE-2016-8919)

Summary

Inside the Tivoli Integrated Portal there is a potential denial of service with WebSphere Application Server with SOAP connectors in the underlying eWAS.

Vulnerability Details

Please consult the Security Bulletin: Denial of Service with WebSphere Application Server (CVE-2016-8919) for vulnerability details and information about fixes.

Affected Products and Versions

FastBack for Workstations Central Administration Console (CAC) 6.3.

Remediation/Fixes

FastBack for Workstations CAC 6.3
The fix for FastBack for Workstations CAC 6.3 will be to update the embedded eWAS included with the Tivoli Integrated Portal to 7.0.0.41 and then apply the WAS interim fix pack PI73519.

Update embedded eWAS to 7.0.0.41
To update the embedded eWAS included with the Tivoli Integrated Portal to 7.0.0.41, click on the following link:
http://www.ibm.com/support/docview.wss?uid=swg21981056
and then download 7.0.0-WS-WASEmbeded-WinX32-FP0000041.pak

To update the embedded eWAS, do the following:

1. If not already at the CAC 6.3.1.1 version upgrade to this version.
2. Stop the Tivoli Service: Tivoli Integrated Portal - V2.2_TIPProfile_Port_16310
3. Using the Update Installer application (update.exe) found in the Tivoli Integrated Portal installation directory (default location: C:\IBM\Tivoli\Tipv2_fbws\WebSphereUpdateInstallerV7) apply the 7.0.0-WS-WASEmbeded-WinX32-FP0000041.pak file downloaded earlier

Apply WAS interim fix pack PI73519
In order to obtain the PI73519 fix, refer to the WAS security bulletin:_
_<http://www-01.ibm.com/support/docview.wss?uid=swg24043247&gt;
Click on the Fix Central (FC) download link for 7.0.0.37-WS-WAS-IFPI73519. Once downloaded, there will be a Readme.txt file and a 7.0.0.37-WS-WAS-IFPI73519.pak file.

To apply the interim fix after having upgraded to eWAS 7.0.0.41, do the following:

1. Using the Update Installer application (update.exe) found in the Tivoli Integrated Portal installation directory (default location: C:\IBM\Tivoli\Tipv2_fbws\WebSphereUpdateInstallerV7) apply the 7.0.0.37-WS-WAS-IFPI73519.pak file downloaded earlier
2. Restart the Tivoli Service or reboot the machine

Workarounds and Mitigations

None