IV82438: SERVER PATH DISPLAYED AT VARIOUS INSTANCES

3.4.2-TIV-TAP-FP003-WIN
3.4.2-TIV-TAP-FP003-README
3.4.2-TIV-TAP-FP003-LIN
3.4.2-TIV-TAP-FP003-AIX
3.5.0-TIV-TAP-FP001-WIN
3.5.0-TIV-TAP-FP001-README
3.5.0-TIV-TAP-FP001-LIN
3.5.0-TIV-TAP-FP001-AIX

APAR status

• Closed as fixed if next.

Error description

• It is possible to retrieve the absolute path of the web server
  installation, which might help an attacker to develop further
  attacks and to gain information about the file system structure
  of the web application.
  One example that was found (out of several throughout the
  application):
  URL: https://<<SERVER>>>/birt/frameset?
  _docId=15691238&_langId=1&_primaryGroupId=10002490&_secondaryGro
  upId=100
  8&__svg=false&__locale=en_US&__showtitle=false&_queryId=133972&_
  _report=
  C:\IBM\Tririga350B\userfiles\birt\resources\15691238-
  1452325440860\Balance_Sheet_Future_Accounting.rptdesign
  This is seen throughout the application.
  

Local fix

• no
  

Problem summary

• The BIRT framework allowed the full path to be passed in via a
  http parameter.
  

Problem conclusion

• A security vulnerability was mitigated in BIRT report preview
  in which some server data was revealed.  This is targeted to
  the 1H2016 mod release and 3.5.0.1 and 3.4.2.3 fix packs.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• 999
  

Fix information

Applicable component levels