IV75080: AN ERROR IS DETECTED FROM NESSUS VULNERABILITY SCAN AFTER UPGRADING IEMSCA TO 1.6.33

APAR status

• Closed as program error.

Error description

• Problem description:
  An error was detected on Nessus Vulnerability Scan after
  upgrading IEMSCA to 1.6.33 from 1.5.92:
   https://w3.secintel.ibm.com/vscan/refs/refs.php?nav=0&vuln_id=2
  382
  It seems that this error could be detected by that files under
  WEB-INF on Web server can be seen/shown on Web server after
  upgrading to v1.6.33.
  
  On Web server, it is NOT allowed that users can directly see
  files under WEB-INF.
  However, after upgrading IEMSCA to 1.6.33, it has been changed
  to be allowed that users can directly see files under WEB-INF
  on the Web server.
  When it is "WEB-INF./" as below(not "WEB-INF/"), files under
  WEB-INF can be shown on the Web server:
  
   <SCA server>/WEB-INF./web.xml
  
  For more detail;
  On v1.5.92, "web.xml" wasn't shown with 404 error on the Web
  server.
  

Local fix

Problem summary

• SCA 1.6 allows users to access non sensitive static information.
  

Problem conclusion

• This issue is resolved in SCA 1.7.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TV EP MG DSS SC

• Fixed component ID

  5725C43SC

Applicable component levels

• R920 PSY

     UP