LI77129: LOCAL WEBSPHERE CAST IRON USERS DEFINED IN VIEWER GROUP HAVE ADDITIONAL UNINTENDED PRIVILEDGES

APAR status

• Closed as program error.

Error description

• WebSphere Cast Iron 6.3 users who are defined in the the local
  "viewer" group have unintended elevated privilege which allows
  it to be able to publish projects onto the appliance
  

Local fix

• Verify that your appliance users, under the "user" and
  "viewer" groups, are trusted with the role of publishing
  projects.
  

Problem summary

• As a result of an unintended elevated privilege, users under the
  local "viewer" or "user" groups are able to publish projects
  onto the appliance.
  As a work around, verify that your appliance users, under the
  "user" and "viewer" groups, are trusted with the role of
  publishing projects.
  

Problem conclusion

• The WebSphere Cast Iron code has been updated and the elevated
  privilege has been corrected.
  This fix is targeted for inclusion in WebSphere Cast Iron fix
  pack 6.3.0.1
  
  Announcements of new fix packs are made on the WebSphere Cast
  Iron Support Portal at
  http://www-947.ibm.com/support/entry/portal/Overview/Software/We
  bSphere_Cast_Iron_Cloud_integration
  
  Fix pack planned delivery schedules can be viewed here:
  http://www-01.ibm.com/support/docview.wss?uid=swg27036374
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WS CASTIRON HV

• Fixed component ID

  5725C1100

Applicable component levels

• R630 PSY

     UP