Tag: was 8

WebSphere v.7 & v.8 End of Support – 18 Months Out

Posted on | by

[et_pb_section bb_built=”1″ _builder_version=”3.0.60″ background_color=”#ffffff”][et_pb_row][et_pb_column type=”4_4″][et_pb_text _builder_version=”3.0.65″ background_layout=”light” text_orientation=”left” border_style=”solid”]

WebSphere v.7 & v.8 End of Support

Are you currently running on what will be an unsupported version of WAS? Do you have a migration or upgrade plan outline for the WebSphere v.7 & v.8 End of Support?
As of April 30th 2018, IBM will discontinue support on all versions of WebSphere Application Server running on Java 6. This means that WAS release v7, v8 and v8.5 – if on Java – will no longer qualify for IBM support within the next 18 months.
It’s recommended that you migrate to WebSphere Application Server v.8.5 or v.9.0 to avoid potential security issues that may occur on the early, unsupported versions of WAS and Java.

Why should you go through a WAS upgrade?

Many security risks can percolate when running back-level software, especially WAS versions running on older Java versions. If you’re currently running on software versions that are out of support, finding the right support team to put out your unexpected fires can be tricky and might just blow the budget.
Upgrading WAS to supported versions will allow you to tap into new and expanding capabilities, and updated performance enhancements while also protecting yourself from unnecessary, completely avoidable security risks.

WebSphere Application Server v.9 Highlights

WebSphere Application Server v.9.0 offers unparalleled functionality to deliver modern applications and services quickly, securely and efficiently.
When you upgrade to v.9.0, you’ll enjoy several upgrade perks including:

  • Java EE 7 compliant architecture
  • DevOps workflows
  • Easy connection between you on-prem apps and IBM Bluemix services (including IBM Watson)
  • Container technology that enables greater development and deployment agility.
  • Deployment on Pivotal Cloud Foundry, Azure, Openshift, Amazon Web Services and Bluemix.
  • Ability to provision workloads to IBM cloud (for VMware customers)
  • Enhancements to WebSphere extreme scale that have improved response times and time-to-configuration

Why work with an IBM Business Partner to upgrade WAS after WebSphere v.7 & v.8 End of Support?

You can choose to work with IBM directly – we can’t (and won’t) stop you – but your budget just might. Working with a premier IBM business partner allows you to accomplish the same task with the same quality, but at a fraction of the price IBM will charge you, with more personal attention and much speedier response times.
Also, IBM business partners are typically niche players, uniquely qualified to assist in your company’s migration planning and execution. They’ll offer you and your company much more customized and consistent attention. Plus, you’ll probably be working with ex-IBMers anyway, who’ve turned in their blue nametags to find greater opportunities working within the business partner network.

There are plenty of things to consider when migrating your software from outdated versions to more current versions. TxMQ is a premier IBM business partner that works with customers to oversee and manage WAS migration and upgrade planning. TxMQ subject matter experts are uniquely positioned with relevant experience, allowing them to help a wide range of customers determine the best solution for their migration needs. Get in touch with us today to discuss your migration and back-level support options.
[/et_pb_text][/et_pb_column][/et_pb_row][et_pb_row _builder_version=”3.0.60″ background_position_1=”top_left” background_repeat_1=”no-repeat”][et_pb_column type=”4_4″][et_pb_code admin_label=”Code – HubSpot CTA” _builder_version=”3.0.65″]<!–HubSpot Call-to-Action Code –><span class="hs-cta-wrapper" id="hs-cta-wrapper-2973e841-2d60-44b4-9856-0c0e7e712683"><span class="hs-cta-node hs-cta-2973e841-2d60-44b4-9856-0c0e7e712683" id="hs-cta-2973e841-2d60-44b4-9856-0c0e7e712683"><!–[if lte IE 8]><div id="hs-cta-ie-element"></div><![endif]–><a href="https://cta-redirect.hubspot.com/cta/redirect/2682341/2973e841-2d60-44b4-9856-0c0e7e712683" target="_blank" ><img class="hs-cta-img" id="hs-cta-img-2973e841-2d60-44b4-9856-0c0e7e712683" style="border-width:0px;" height="90" width="728" src="https://no-cache.hubspot.com/cta/default/2682341/2973e841-2d60-44b4-9856-0c0e7e712683.png" alt="What's your WebSphere Migration Plan? Let's talk about it!"/></a></span><script charset="utf-8" src="https://js.hscta.net/cta/current.js"></script><script type="text/javascript"> hbspt.cta.load(2682341, '2973e841-2d60-44b4-9856-0c0e7e712683', {}); </script></span><!– end HubSpot Call-to-Action Code –>[/et_pb_code][/et_pb_column][/et_pb_row][/et_pb_section]

Potential Security Issues fixed In IBM WAS 8.0.0.8

Posted on | by admin

Beware potential forgery.
WebSphere Application Server (WAS) could be vulnerable to a cross-site request forgery, caused by improper validation of portlets in the administrative console. By persuading a user to visit a malicious web site, a remote attacker could exploit this vulnerability to obtain sensitive information.
CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/81014 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
AFFECTED VERSIONS: The following IBM WebSphere Application Server (IBM WAS) Versions are affected:
Version 8.5
Version 8.0
Version 7
Version 6.1
REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM72275, as noted below:
For IBM WebSphere Application Server
For V8.5 through 8.5.5.0:
Apply Fix Pack 1 (8.5.5.1), or later.
For V8.0 through 8.0.0.7:
Apply Fix Pack 8 (8.0.0.8), or later.
For V7.0 through 7.0.0.25:
Apply Fix Pack 27 (7.0.0.27), or later.
For V6.1.0 through 6.1.0.45:
Apply Fix Pack 47 (6.1.0.47), or later.
Workaround(s): None
Mitigation(s): none
CVE ID: CVE-2013-4053 (PM90949 and PM91521)
DESCRIPTION: WebSphere Application Server using WS-Security and configured for XML Digital Signature using trust store, could allow a network attacker to gain elevated privileges on the system, caused by improper checking of the certificate.
CVSS:
CVSS Base Score: 6.8
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/86505 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:P/I:P/A:P)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
Version 8.5
Version 8
Version 7
Version 6.1
REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF for WebSphere Application Server as noted below:
For IBM WebSphere Application Server (PM90949)
For V8.5 through 8.5.5.0:
Apply Fix Pack 1 (8.5.5.1), or later.
For V8.0 through 8.0.0.7:
Apply Fix Pack 8 (8.0.0.8), or later.
For V7.0 through 7.0.0.29:
Apply Fix Pack 31 (7.0.0.31), or later.
For V6.1.0 through 6.1.0.45:
Apply Fix Pack 47 (6.1.0.47), or later.
OR
APAR Interim Fix:
Find your applicable Version for APAR Interim Fix PM90949
Ensure you are at the minimally required Fix Pack Level before installing the APAR Interim Fix, then
Apply the APAR Interim Fix
For IBM WebSphere Application Server Feature Pack for Web Services (PM91521)
For V6.1.0 through 6.1.0.45:
Apply Fix Pack 47 (6.1.0.47), or later.
OR
APAR Interim Fix:
Find your applicable Version for APAR Interim Fix PM91521
Ensure you are at the minimally required Fix Pack Level before installing the APAR Interim Fix, then
Apply the APAR Interim Fix
Workaround(s): None
Mitigation(s): none
CVE ID: CVE-2013-4052 (PM91892)
DESCRIPTION: WebSphere Application Server could allow a cross-site scripting attack, caused by improper validation of input in the UDDI Administrative console. A network attacker could exploit this vulnerability using a specially-crafted URL to inject script into a victim’s Web browser within the security context of the hosting Web site.
CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/86504 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
Version 8.5
Version 8
Version 7
Version 6.1
REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM91892, as noted below:
For IBM WebSphere Application Server
For V8.5 through 8.5.5.0:
Apply Fix Pack 1 (8.5.5.1), or later.
For V8.0 through 8.0.0.7:
Apply Fix Pack 8 (8.0.0.8), or later.
For V7.0 through 7.0.0.29:
Apply Fix Pack 31 (7.0.0.31), or later.
For V6.1.0 through 6.1.0.45:
Apply Fix Pack 47 (6.1.0.47), or later.
Workaround(s): None
Mitigation(s): none
CVE ID: CVE-2013-5414 (PM92313)
DESCRIPTION: WebSphere Application Server could allow existing users to gain elevated privileges on the system caused by incorrect Administration Security roles being assigned after migration from version 6.1 or later.
NOTE: If a migration from WebSphere Application Server Version 6.1 or later has already been performed, all users designated with “adminsecmanager” (Administrative Security Manager) role need to be evaluated to determine if they should have both “admin” role and “adminsecmanager” role. Some users may not need both designations and the privileges should be removed accordingly.
CVSS:
CVSS Base Score: 3.5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87476 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:S/C:N/I:P/A:N)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
Version 8.5
Version 8
Version 7
REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM92313, as noted below:
For IBM WebSphere Application Server
For V8.5 through 8.5.5.0:
Apply Fix Pack 1 (8.5.5.1), or later.
For V8.0 through 8.0.0.7:
Apply Fix Pack 8 (8.0.0.8), or later.
For V7.0 through 7.0.0.29:
Apply Fix Pack 31 (7.0.0.31), or later.
Workaround(s): If a migration from WebSphere Application Server Version 6.1 or later has already been performed, all users designated with “adminsecmanager” role need to be evaluated to determine if they should have both “admin” role and “adminsecmanager” (Administrative Security Manager) role. Some users may not need both designations and the privileges should be removed accordingly.
Mitigation(s): none
CVE ID: CVE-2013-5417 (PM93323 and PM93944)
DESCRIPTION: WebSphere Application Server could be vulnerable to cross-site scripting, caused by improper validation of application HTTP response data.
CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87479 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
Version 8.5
Version 8
Version 7
REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing APAR PM93323 for IBM WebSphere Application Server Full Profile or APAR PM93944 for IBM WebSphere Application Server Liberty Profile, as noted below:
For IBM WebSphere Application Server Full Profile
For V8.5 through 8.5.5.0:
Apply Fix Pack 1 (8.5.5.1), or later.
For V8.0 through 8.0.0.7:
Apply Fix Pack 8 (8.0.0.8), or later.
For V7.0 through 7.0.0.29:
Apply Fix Pack 31 (7.0.0.31), or later.
For IBM WebSphere Application Server Liberty Profile
For V8.5 through 8.5.5.0:
Apply Fix Pack 1 (8.5.5.1), or later.
Workaround(s): None
Mitigation(s): none
CVE ID: CVE-2013-5418 (PM96477)
DESCRIPTION: WebSphere Application Server could allow a cross-site scripting attack, caused by improper validation of input in the Administrative console. A remote attacker could exploit this vulnerability using a specially-crafted URL to inject script into a victim’s Web browser within the security context of the hosting Web site.
CVSS:
CVSS Base Score: 3.5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87480 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:S/C:N/I:P/A:N)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
Version 8.5
Version 8
Version 7
REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM96477, as noted below:
For IBM WebSphere Application Server
For V8.5 through 8.5.5.0:
Apply Fix Pack 1 (8.5.5.1), or later.
For V8.0 through 8.0.0.7:
Apply Fix Pack 8 (8.0.0.8), or later.
For V7.0 through 7.0.0.29:
Apply Fix Pack 31 (7.0.0.31), or later.
Workaround(s): None
Mitigation(s): none
CVE ID: CVE-2013-6725 (PM98132)
DESCRIPTION: IBM WebSphere Application Server may be vulnerable to cross-site scripting, caused by improper validation of input in the Administrative Console. A remote attacker with Administrative authority could exploit this vulnerability using a specially-crafted URL to inject script into a victim’s Web browser within the security context of the hosting Web site.
CVSS:
CVSS Base Score: 3.5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/89280 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:S/C:N/I:P/A:N)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
Version 8.5
Version 8
Version 7
REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM98132, as noted below:
For IBM WebSphere Application Server
For V8.5 through 8.5.5.1:
Apply Fix Pack 2 (8.5.5.2), or later (targeted to be available 28 April 2014).
For V8.0 through 8.0.0.7:
Apply Fix Pack 8 (8.0.0.8), or later.
For V7.0 through 7.0.0.29:
Apply Fix Pack 31 (7.0.0.31), or later.
Workaround(s): None
Mitigation(s): none
CVE ID: CVE-2013-6325 (PM99450)
DESCRIPTION: IBM WebSphere Application Server could be vulnerable to a denial of service, caused by improper handling of requests by a web services endpoint. By passing a specially-crafted request, a remote attacker could exploit this vulnerability to consume available resources.
CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/88906 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:N/A:P)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
Version 8.5
Version 8
Version 7
REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM99450, as noted below:
For IBM WebSphere Application Server
For V8.5 through 8.5.5.1:
Apply Fix Pack 1 (8.5.5.2), or later (targeted to be available 28 April 2014).
For V8.0 through 8.0.0.7:
Apply Fix Pack 8 (8.0.0.8), or later.
For V7.0 through 7.0.0.29:
Apply Fix Pack 31 (7.0.0.31), or later.
Workaround(s): None
Mitigation(s): none
IBM SDK: Please refer to this security bulletin for SDK fixes that were shipped with WebSphere Application Server Version 7.0.0.31
http://www.ibm.com/support/docview.wss?&uid=swg21655990
Important note:
IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.
Reference: http://www-01.ibm.com/support/docview.wss?uid=swg21661325&acss=danl_334_email
(Photo courtesy of Flickr contributor brykmantra.)