IZ55562: IMS SERVER ? TOMCAT SERVER DOWNLEVEL

APAR status

• Closed as program error.

Error description

• Problem:
  
  There are a number of security vulnerability issues reported for
  the versions of tomcat provided with 8.0.x, 8.0.1 (5.5.23)
  
  
  Reference : http://tomcat.apache.org/security-5.html
  
  After analysis, two effect the IMS server, both referenced as
  low risk:
  
    CVE-2007-3382 and CVE-2007-3385
  
  Here is the ranking system described:
    http://tomcat.apache.org/security-impact.html
  
  Env:
    TAM E-SSO IMS Server 8.0.1
    Windows Server 2003, Standard Edition, SP2
    Enterprise Directory - AD
    Private Workstation - Private Desktop
  
  Expect Behavior:
    Security vulnerabilities to be resolved.
  

Local fix

• NA
  

Problem summary

• The exposures will be fixed in TAM ESSO 8.0.1 Fixpack 1 and
  8.0.0 Fixpack 2.
  

Problem conclusion

• The exposures listed are low priority due to the fact that it
  requires Administrative authority on the IMS server to exploit
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TAM ESSO IM SVR

• Fixed component ID

  5724V6700

Applicable component levels

• R800 PSY

     UP

• R801 PSY

     UP