Security Bulletin: Vulnerabilities in Apache Struts affects FastBack for Workstations Central Administration Console (CVE-2016-1181 and CVE-2016-1182)

Summary

Apache Struts vulnerabilities affect FastBack for Workstations Central Administration Console.

Vulnerability Details

CVEID: CVE-2016-1181**
DESCRIPTION:** Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the failure to protect against unintended remote operations against components on server memory by the ActionForm instance. An attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/113852 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID: CVE-2016-1182**
DESCRIPTION:** Apache Struts could allow a remote attacker to bypass security restrictions, caused by the improper validation of input by the Validator. An attacker could exploit this vulnerability to modify validation rules and error messages.
CVSS Base Score: 4.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/113853 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)

Affected Products and Versions

FastBack for Workstations Central Administration Console v6.3

Remediation/Fixes

The fix for FastBack for Workstations CAC 6.3 will be to apply the WAS interim fix pack PI64303 to the version of WAS included with the Tivoli Integrated Portal.
In order to obtain the PI64303 fix refer to the WAS security bulletin:
<http://www-01.ibm.com/support/docview.wss?uid=swg21985995&gt;
Click on the link for v7.0.0.0 through v7.0.0.41 interim fix pack PI64303. Click the HTTPS download link for 7.0.0.33-WS-WAS-IFPI64303.
There will be a Readme.txt file and a 7.0.0.33-ws-was-ifpi64303.pak file.

To apply, do the following:
1. If not already at the CAC 6.3.1.1 version upgrade to this version.
2. Stop the Tivoli Service: Tivoli Intergrated Portal - V2.2_TIPProfile_Port_16310
3. Using the Update Installer application (update.exe) found in the Tivoli Intergrated Portal installation directory
(default location: C:\IBM\Tivoli\Tipv2_fbws\WebSphereUpdateInstallerV7) apply the .pak file downloaded earlier
4. Restart the Tivoli Service or reboot the machine