APAR status

• Closed as program error.

Error description

• Cross-Site Scripting Vulnerabilities within ClearCase RWP server
  
  ClearCase:  7.0.1.1-RATL-RCC-IFIX02
  UNIX:  All Versions
  
  To Reproduce:
  
  1)  Login to the web interface
  2)  Select a View
  3)  Once the VOB page appears, copy the following into the URL:
             ??''??script?alert(1234)?/script?=123
  
  For example:
             http://otter/ccrc/??''??script?alert(1234)?/script?=1
  23
  
  On host Otter, with the following URL, you will see a pop-up win
  dow appear with ?1234? and an OK button:  Once you press OK, you
   are returned to the login screen with ? value?123??  printed at
   the top left of the login prompt.
  
  
  WORKAROUND:  none
  

Local fix

Problem summary

• The ClearCase Web Interfaces has a cross-site scripting
  (XSS) vulnerability.
  

Problem conclusion

• Fixed in ClearCase versions 7.0.0.4 and 7.0.1.3
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  CLEARCASE UNIX

• Fixed component ID

  5724G2901

Applicable component levels

• R700 PSN

     UP

IBM, the IBM logo and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.

Product categories:

Software

Software Development

Change, Configuration, & Release Management

Rational ClearCase

Software version:

700

Reference #:

PK70972

IBM Group:

Software Group

Modified date:

2008-12-01