IBM Security Bulletin: Authentication vulnerability affects IBM Integration Bus  V10.0.0.4 onwards (CVE-2016-8918 ) - United States WMB IIB SECURITY BULLETIN

SUMMARY
 Web user accounts can be authenticated against an LDAP server, in IBM Integration Bus V10.0.0.4 and later versions. However, under some circumstances it is possible for a remote user to be authenticated without providing valid credentials.

VULNERABILITY DETAILS
CVEID: CVE-2016-8918 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8918]
DESCRIPTION: In non-default configurations, IBM Integration Bus could allow a remote user to authenticate without providing valid credentials.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/118528 [https://exchange.xforce.ibmcloud.com/vulnerabilities/118528] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)

AFFECTED PRODUCTS AND VERSIONS
IBM Integration Bus V10

REMEDIATION/FIXES

Product VRMF APAR Remediation/Fix IBM Integration Bus V10 IT15920 The APAR is available in Fix Pack 10.0.0.7
https://www-304.ibm.com/support/docview.wss?uid=swg24043068 [https://www-304.ibm.com/support/docview.wss?uid=swg24043068]

For unsupported versions of the product, IBM recommends upgrading to a fixed, supported version/release/platform of the product.
The planned maintenance release dates for WebSphere Message Broker and IBM Integration Bus are available at :
http://www.ibm.com/support/docview.wss?uid=swg27006308 [http://www.ibm.com/support/docview.wss?uid=swg27006308]

WORKAROUNDS AND MITIGATIONS
None

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

IMPORTANT NOTE
 IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site [http://www.ibm.com/systems/z/solutions/security_subintegrity.html]. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.

REFERENCES
Complete CVSS v3 Guide [http://www.first.org/cvss/user-guide]
On-line Calculator v3 [http://www.first.org/cvss/calculator/3.0]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

CHANGE HISTORY
 2 Dec 2016 - Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

PRODUCT ALIAS/SYNONYM
 WMB IIB

Question: Help with Security Bulletin: Authentication vulnerability affects IIB V10.0.0.4 onwards (CVE-2016-8918 ) I need to understand details regarding Security Bulletin: Authentication vulnerability affects IBM Integration Bus V10.0.0.4 onwards (CVE-2016-8918 ). Where can I find this information?

Answer:
CVEID: CVE-2016-8918 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8918]
DESCRIPTION: In non-default configurations, IBM Integration Bus could allow a remote user to authenticate without providing valid credentials.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/118528 [https://exchange.xforce.ibmcloud.com/vulnerabilities/118528] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)


IBM Purging the connection pool of a WebSphere Application Server data source using the data source MBean - United States was app server TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 During the testing or troubleshooting of an enterprise application, it may become necessary to purge the connection pool of a WebSphere Application Server data source of existing connections.

SYMPTOM
Changes to the application or environment may invalidate cached connections in the Connection Manager pool. Although these connections will eventually be discarded through the normal processing of the connection requests, it may be desirable to purge them all at once and allow the pool to refill with new, valid connections.

RESOLVING THE PROBLEM
WebSphere Application Server has an operation on the data source MBean that can be used to purge the connection pool. WebSphere Application Server MBean may be called via the wsadmin console, see the IBM Information Center topic "Scripting the application serving environment (wsadmin)" for more details. The operation name is: purgePoolContents.

The purgePoolContents operation has two options:

 1. Normal:  * This is the default option.
     * Existing in-flight transactions will be allowed to continue work.
     * Shared connection requests will be honored.
     * Free connections are cleaned up and destroyed.
     * In use connections (for example: connections in transactions) are cleaned up and destroyed when returned to the connection pool.
     * A close() call issued on any connection obtained prior to the purgePoolContents will be done synchronously (for example: wait for the jdbc driver to return before proceeding).
     * Requests for new connections (not handles to existing old connections) will be honored.

 2. Immediate:  * No new transactions will be allowed to start on any connections obtained prior to the purgePoolContents call. Instead, a StaleConnectionException is thrown.
     * No new handles will be handed out on any connections obtained prior to the purgePoolContents call. Instead, a StaleConnectionException is thrown.
     * Existing in-flight transactions will be allowed to continue work. Any new activities on a purged Connection will cause a StaleConnectionException or an XAER_FAIL exception (in the case of XA)
     * A close() call issued on any connection obtained prior to the purgePoolContents call will be done asynchronously (for example: no waiting for the jdbc driver to return) This is useful if the driver returns.
     * Due to the fact that close() does not wait, the number of connections will be decremented immediately in WebSphere Application Server. This might cause the total number of connections in WebSphere Application Server to be temporarily out of sync with the database total number of connections.
     * Requests for new connections (for example: not handles to existing old connections) will be honored.

Examples of operations that can be executed on the data source MBean using the wasdmin console:  1. List all data sources:
    Using Jacl:
    $AdminControl queryNames *:type=DataSource,*

    Using Jython:
    AdminControl.queryNames("*:type=DataSource,*")

 2. Initialize a variable to specify a data source (this example uses Default Datasource, but any data source name listed in the output of above command can be used):
    Using Jacl:
    set name "Default Datasource"
    set ds [$AdminControl queryNames *:type=DataSource,name=$name,*]

    Using Jython:
    name = "Default Datasource"
    ds = AdminControl.queryNames("*:type=DataSource,name="+name+",*")

 3. View the pool contents by invoking the showPoolContents operation of the data source MBean:
    Using Jacl:
    $AdminControl invoke $ds showPoolContents

    Using Jython:
    print AdminControl.invoke(ds, "showPoolContents")

 4. View contents of all pools by invoking the showAllPoolContents operation of the data source MBean:
    Using Jacl:
    $AdminControl invoke $ds showAllPoolContents

    Using Jython:
    print AdminControl.invoke(ds, "showAllPoolContents")

 5. Immediately purge the pool by invoking the purgePoolContents operation of the data source MBean with the immediate option:
    Using Jacl:
    $AdminControl invoke $ds purgePoolContents immediate

    Using Jython:
    AdminControl.invoke(ds, "purgePoolContents", "immediate")

If the purge operation is successful, no response will be observed. If the purge operation is not successful, the response will indicate a possible reason for failure. One common reason for failure is attempting to purge the contents of a connection pool which is not yet available (the connection pool is not created until a naming look-up of the associated datasource or connection factory occurs), resulting in an illegal state exception.

Cross reference information Segment Product Component Platform Version Edition Application Servers Runtimes for Java Technology Java SDK Application Servers WebSphere Application Server for z/OS Java SDK z/OS 8.0, 7.0, 6.1

Question: Why does our Websphere application server hang when we apply Microsoft patch on our database server? Why does our Websphere application server hang when we apply Microsoft patch on our database server?

Answer:
Immediately purge the pool by invoking the purgePoolContents operation of the data source MBean with the immediate option:
    Using Jacl:
    $AdminControl invoke $ds purgePoolContents immediate

    Using Jython:
    AdminControl.invoke(ds, "purgePoolContents", "immediate")

If the purge operation is successful, no response will be observed. If the purge operation is not successful, the response will indicate a possible reason for failure.


IBM Netcool conf pack command - United States tool; menu; not found; confpack TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Migrating to a new version of Omnibus, running nco_confpack:

$OMNIHOME/bin/nco_confpack -list -server NCOMS -user ncadmin -file /tmp/nco_confpack.list

Received this error: Tool in menu but not found, menu: AlertsMenu, tool: CLEAR_LWY.

SYMPTOM
The command fails and the following error is received: Tool in menu but not found, menu: AlertsMenu, tool: CLEAR_LWY.

CAUSE
The menu AlertsMenu has a tool in it called CLEAR_LWY, however the tool no longer exists.

RESOLVING THE PROBLEM
Recreate the tool and associate it with the menu and try to run the command again.

Question:
Why does nco_confpack -export fail with the message "Tool in menu but not found"? I tried to export OMNIbus configuration using nco_confpack command and I get the following message:
Tool in menu but not found, menu: AlertsMenu, tool: Close
I've also tried using it with -list command and I get the same error.

Answer: Recreate the tool and associate it with the menu and try to run the command again.


IBM DB2 LUW precompile, prep may write different code to DB2 z/OS - United States  TECHNOTE (FAQ)

QUESTION
 Why does DB2 LUW precompile, prep write different code to DB2 z/OS?

CAUSE
It is an expected current DB2 LUW behavior.

ANSWER
Here is an example.

------------------------------
<Before PRECOMPILE>
01 BLOB1 USAGE ID SQL TYPE IS BLOB(10485760).

<PRECOMPILE on z/OS>
01 BLOB1.
02 BLOB1-LENGTH PIC S9(9) COMP.
02 BLOB1-DATA.
49 FILLER PIC(10485760).

<PRECOMPILE on LUW>
01 BLOB1.
02 BLOB1-LENGTH PIC S9(9) COMP.
02 BLOB1-DATA PIC(10485760).
------------------------------

As above, we see DB2 z/OS has below two lines:
------------------------------
02 BLOB1-DATA.
49 FILLER PIC(10485760).
------------------------------
but DB2 LUW writes only one line as below for above two lines part.
------------------------------
02 BLOB1-DATA PIC(10485760).
------------------------------

It is an expected current DB2 LUW behavior and we don't have any hidden
option to generate the cobol declarations similar to z/OS precompiler.

Note:
This behavior might be changed without notice in the future. We can confirm whether this technote
is valid or not by following above scenario.
Please contact your Sales Rep to submit a potential design change towards a future release.
Or please open a ticket, Request For Enhancement at https://www.ibm.com/developerworks/rfe/ [https://www.ibm.com/developerworks/rfe/]

RELATED INFORMATION
 PRECOMPILE command [http://www.ibm.com/support/knowledgecenter/SSEPGG_10.5.0/com.ibm.db2.luw.admin.cmd.doc/doc/r0001964.html]
COBOL compiler configurations [http://www.ibm.com/support/knowledgecenter/SSEPGG_10.5.0/com.ibm.db2.luw.apdv.embed.doc/com.ibm.db2.luw.apdv.embed.doc-gentopic3.html]

Question:
Any difference between DB2 z/OS V9.1 + IBM Cobol and DB2 LUW V10.5 FP7 + MF Cobol? We are planning below migration.

[Current]
DB2 z/OS V9.1 + IBM Cobol
[New]
DB2 AESE V10.5 FP7 / AIX V7.1 + Micro Focus Cobol (MF Cobol)

Any known limitation or things what we need to concern?

Answer: DB2 LUW precompile, prep write different code to DB2 z/OS?


IBM Installation instructions for IBM Business Process Manager Version 8.5 Refresh Pack 5 - United States 8.5.5 Installation Instructions; install; 8.5 refresh pack PRODUCT README

ABSTRACT
 This document provides instructions for installing V8.5 Refresh Pack 5 for the IBM Business Process Manager products. The same instructions should be used to update the Process Center and the Process Server.

CONTENT

TAB NAVIGATION
 * Refresh Pack download [http://www.ibm.com/support/docview.wss?uid=swg24037683 ]
 * Refresh pack installation instructions [http://www.ibm.com/support/docview.wss?uid=swg27042065]- selected tab,
 * Profile upgrade instructions [http://www.ibm.com/support/docview.wss?uid=swg27042066]
 * Recommended interim fixes [http://www.ibm.com/support/docview.wss?uid=swg24037612]

This refresh pack is a cumulative maintenance package for a specific product and applies to all distributed operating systems. It is a single package that bundles a number of individual fixes.

V8.5 Refresh Pack 5 is intended to be used on IBM Business Process Manager Express, IBM Business Process Manager Standard, IBM Business Process Manager Advanced, and IBM Business Process Manager Advanced - Process Server installations.

By installing V8.5 Refresh Pack 5, you will raise the fix level of your product, either IBM Business Process Manager Express, IBM Business Process Manager Standard, IBM Business Process Manager Advanced, or IBM Business Process Manager Advanced - Process Server, to Version 8.5.5.

Note: You can roll out maintenance incrementally in an IBM Business Process Manager installation that consists of a Process Center and multiple Process Servers. This approach allows you to continually run production applications during the upgrade and regression test period. See [http://www14.software.ibm.com/webapp/wsbroker/redirect?version=matt&product=was-nd-mp&topic=trun_svr_conf_backup] Performing a rolling upgrade [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.doc/topics/tmig_rolling_upgrade.html] in the product documentation.

Table of Contents

 * Problems addressed in this refresh pack
 * Refresh pack prerequisites
 * Installing the refresh pack
 * Upgrade instructions for installations with existing profiles
 * Installing V8.5 Refresh Pack 5
 * Upgrading the Process Designer
 * Refresh pack install verification
 * Rolling back V8.5 Refresh Pack 5
 * Reference
 * Trademarks and service marks

© Copyright International Business Machines Corporation 2014. All rights reserved.
US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

PROBLEMS ADDRESSED IN THIS REFRESH PACK

The fixes addressed in V8.5 Refresh Pack 5 are explained in the Fix List for the IBM Business Process Manager Version 8.5 products [http://www.ibm.com/support/docview.wss?uid=swg27039722]document.
Back to top

Refresh pack prerequisites

To use this refresh pack, you must have Version 8.5 for the IBM Business Process Manager Express, IBM Business Process Manager Standard, IBM Business Process Manager Advanced, or IBM Business Process Manager Advanced - Process Server product installed.

You must have WebSphere Application Server V8.5.5 Fix Pack 2 [http://www.ibm.com/support/docview.wss?uid=swg24037250] installed or you must install WebSphere Application Server V8.5.5 Fix Pack 2 during the upgrade process. This fix pack must be downloaded using FTP. In addition, you must install the fix pack image for all operating systems and platforms.

When you decompress the following two files to the same location, it creates the full WebSphere Application Server V8.5.5 Fix Pack 2 repository that includes all WebSphere Application Server packages for all supported operation systems and architectures:

 * 8.5.5-WS-WAS-FP0000002-part1.zip 0.814 GB
 * 8.5.5-WS-WAS-FP0000002-part2.zip 1.59 GB

Hardware and software prerequisites for IBM Business Process Manager Express [http://www.ibm.com/software/integration/business-process-manager/express/sysreqs/], IBM Business Process Manager Standard [http://www.ibm.com/software/integration/business-process-manager/standard/sysreqs/], IBM Business Process Manager Advanced [http://www.ibm.com/software/integration/business-process-manager/advanced/sysreqs/], and IBM Business Process Manager Advanced - Process Server [http://www.ibm.com/software/integration/business-process-manager/advanced/sysreqs/]are available on the web on their respective Hardware and Software Support pages. Important: If you receive a message warning that the ulimit setting is lower than recommended, set the ulimit value to 8192. Refer to Warnings about GTK or ulimit on Linux or UNIX when installing or migrating [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.admin.doc/topics/rins_trbl_warnings.html].

Back to top

INSTALLING THE REFRESH PACK

Upgrade instructions for installations with existing profiles

If you have been using IBM Business Process Manager Express, IBM Business Process Manager Standard, IBM Business Process Manager Advanced, or IBM Business Process Manager Advanced - Process Server V8.5 and you have created profiles, additional steps are required. Also, if you installed the product using the Typical installation, a profile was created and you must follow these steps. These steps include backing up the profile, stopping all Java™ processes, and sequencing the upgrade. Before you continue with the refresh pack installation, follow the appropriate documentation for details and return to this document, when instructed, to complete the Version 8.5 Refresh Pack 5 installation.

Important:
Depending on the source version and topology, instructions for updating the database vary. The product might not continue to run successfully if you do not follow the instructions.

If you are upgrading the environment from an IBM Business Process Manager 8.5 product to V8.5 Refresh Pack 5, follow the steps in Profile upgrade instructions for IBM Business Process Manager Version 8.5 Refresh Pack 5 [http://www.ibm.com/support/docview.wss?uid=swg27042066].

Back to top

Installing V8.5 Refresh Pack 5

If you have existing profiles under this installation, before you continue with the refresh pack installation, see [http://www.ibm.com/support/docview.wss?uid=swg27038089]Profile upgrade instructions for IBM Business Process Manager Version 8.5 Refresh Pack 5 [http://www.ibm.com/support/docview.wss?uid=swg27042066] for details on the steps to follow for the various topologies. Return to this document, when instructed, to complete the Version 8.5 Refresh Pack 5 installation.

Download repositories to the local system
The IBM Installation Manager must be at a minimum level of Version 1.6.0 before you start the IBM Business Process Manager 8.5 Refresh Pack 5 installation updates. The Installation Manager detects an available update if you are connected to the Internet on the workstation on which you are planning to complete the IBM Business Process Manager 8.5 Refresh Pack 5 update activities. WebSphere Application Server V8.5.5 Fix Pack 2 [http://www.ibm.com/support/docview.wss?uid=swg24037250] is a prerequisite to IBM Business Process Manager Express, IBM Business Process Manager Standard, IBM Business Process Manager Advanced, or IBM Business Process Manager Advanced - Process Server V8.5 Refresh Pack 5.

If the machine where you are upgrading the product has Internet access, skip the following steps.

 1. Download the appropriate refresh pack using the Version 8.5 Refresh Pack 5 for the IBM Business Process Manager products [http://www.ibm.com/support/docview.wss?uid=swg24037683] document. Download bpm.8550.delta.repository.zip to a temporary disk location.

 2. Download and installWebSphere Application Server Version 8.5.5 Fix Pack 2 [http://www.ibm.com/support/docview.wss?uid=swg24035935], if it is not yet installed. IBM Business Process Manager no longer bundles the WebSphere Application Server fix pack. This fix pack, which is required for IBM Business Process Manager, is available through Fix Central.

    When you decompress the following two files to the same location, it creates the full WebSphere Application Server V8.5.5 Fix Pack 2 repository that includes all WebSphere Application Server packages for all supported operation systems and architectures:

    8.5.5-WS-WAS-FP0000002-part1.zip 0.814 GB
    8.5.5-WS-WAS-FP0000002-part2.zip 1.59 GB

 3. Unpack the repositories to any directories that you choose. Note where you have unpacked the repositories. You should unpack each repository to its own directory.

You can install the fix packs by using one of the following options:
Graphical user interface (GUI) of IBM Installation Manager to update an installation
Command line interface of IBM Installation Manager for a silent installation

Graphical user interface (GUI) of IBM Installation Manager to update an installation

 1. Start the Installation Manager.

    On Windows operating systems with Internet access, click Start > Programs > IBM > IBM_BUSINESS_MANAGER_PRODUCT > Update. Then skip to step 3b.

    If you are on a Linux or UNIX-based system, start IBM Installation Manager using the install_location/IBMIM command. On Windows operating systems, use the install_root\IBMIM.exe command. See Installation directories for the product and profile [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.doc/topics/rins_installation_paths.html] for more information on where Installation Manager is installed.

    Note: On Microsoft Windows operating systems, right-click install_root\IBMIM.exe and select Run as administrator.

 2. Add repositories to the IBM Installation Manager preferences.

    Click File > Preferences. Under Repositories, select one of the following options:  * If you have Internet access, ensure that the Search service repositories during installation and updates option is selected.

     * If you do not have Internet access, add the location of all the local repositories that you downloaded from the Download repositories to local system section.  1. Click Add Repository.

        2. Type or browse to the repository.config file for the IBM Business Process Manager repository that you have unpacked.

        3. Click OK.

        4. Repeat this process for the interim fix repositories and the WebSphere Application Server fix pack repository, if necessary.

        5. Click OK to save the new repository settings.

 3. Use the following steps to install graphically:  1. Click Update.

     2. Select the Package Group where you have installed IBM Business Process Manager Express, IBM Business Process Manager Standard, IBM Business Process Manager Advanced, or IBM Business Process Manager Advanced - Process Server.

     3. Click Next > to continue.

        After Installation Manager checks the service repositories, the Update Packages window opens and the IBM Business Process Manager Express, IBM Business Process Manager Standard, IBM Business Process Manager Advanced, or IBM Business Process Manager Advanced - Process Server Version 8.5 Refresh Pack 5 is shown, unless there is a later fix pack available from the live update repository.

        If you are installing WebSphere Application Server Version 8.5.5 Fix Pack 2, that is also shown.

     4. Ensure that the refresh pack and fix pack are selected. Clear the Show recommended only check box, so that you will be able to see the WebSphere Application Server interim fixes in the next step. Click Next >. If you have Internet connectivity or have added local interim fix repositories, another Update Packages window opens. A list of interim fixes is displayed.

     5. Select all the recommended interim fixes for IBM Business Process Manager V8.5.5 and all the recommended interim fixes for WebSphere Application Server. Refer to Recommended interim fixes for IBM Business Process Manager V8.5 Refresh Pack 5 [http://www.ibm.com/support/docview.wss?uid=swg24037612].

     6. Ensure that the interim fixes are all selected and then click Next > to continue. The Licenses window opens.

     7. Read and accept the terms of the license agreements by selecting the appropriate button and click Next > to continue. The Features window opens. All of the installed features will be selected.

     8. Click Next > to continue. The Summary window opens. All of the features that need to be updated are shown. The disk space that is required to perform the update is shown at the bottom.

     9. Click Update to start the update. The updates are downloaded either from the live update repository or from your local repository. The updates are installed. After the installation of the updates is complete, you receive a confirmation.

 *

Note:During a full installation when you have Internet access, follow the normal installation instructions for a full installation. Go to Install Packages> Check for Other Versions and Extensions. All of the latest versions are discovered. Follow the instructions to select the Show all versionscheck box, and then proceed with the full installation as normal.
Back to top

Command line interface of IBM Installation Manager for a silent installation

Installation Manager offers a command-line interface to update your product installation silently.
 1. Use the following command to update your IBM Business Process Manager product to V8.5 Refresh Pack 5:

    IM_INSTALL_LOCATION/tools/imcl install PACKAGE_IDS FIX_IDS -acceptLicense -installationDirectory INSTALL_DIR-repositories REPOSITORIES-log LOG_FILE

    Update the variables in the previous command specifically for your installation using the following information:

     * IM_INSTALL_LOCATION
       This variable represents the location where Installation Manager is installed. See Installation directories for the product and profile [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.doc/topics/rins_installation_paths.html] for more information on Installation Manager default installation directories.

     * PACKAGE_IDS
       This variable represents the list of packages to be updated. Package IDs are separatedby spaces. Use the following list to get the correct package IDs for your product.

        * IBM Business Process Manager Express
          com.ibm.bpm.EXP.v85
          com.ibm.websphere.ND.v85
        * IBM Business Process Manager Standard
          com.ibm.bpm.STD.v85
          com.ibm.websphere.ND.v85
        * IBM Business Process Manager Advanced
          com.ibm.bpm.ADV.v85
          com.ibm.websphere.ND.v85
        * IBM Business Process Manager Advanced - Process Server
          com.ibm.bpm.PS.v85
          com.ibm.websphere.ND.v85

     * FIX_IDS
       This variable represents the interim fix IDs for any interim fixes that you need to install.

     * INSTALL_DIR
       This variable represents the installation directory of the product.

     * REPOSITORIES
       This variable represents the location of the refresh pack and interim fix repositories.

       Note: Use commas to separate multiple locations.

     * LOG_FILE
       This variable represents the location and name of the silent log file to write.

       By including the -acceptLicense parameter, you agree to the terms and licenses of this product.

 2. After updating the command for your environment, run the command from the tools directory under the Installation Manager install location.

    The following command is an example in which only the IBM Business Process Manager refresh pack needs to be applied:
    C:\Program Files (x86)\IBM\Installation Manager\eclipse\tools\imcl install com.ibm.bpm.PS.v85 -acceptLicense -installationDirectory C:\IBM\BPM\v8.5 -repositories C:\BPM855_repository -log silent_update.txt
 3. When the silent refresh pack installation completes, check the log files to ensure that the installation completes successfully. A success message that is similar to the following text displays on the command line:

    Updated to com.ibm.bpm.ADV.v85_8.5.5000.20140604_1130 in the C:\IBM\BPM\v8.5 directory

For additional information about silent installations, visit the product documentation links in the following table: Product Content Links IBM Business Process Manager Express [http://pic.dhe.ibm.com/infocenter/dmndhelp/v8r0m1/topic/com.ibm.wbpm.imuc.stbpm.doc/topics/inst_sil_cmd_lin.html]AIX [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.stbpm.doc/topics/inst_sil_cmd_aix.html]
Linux [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.stbpm.doc/topics/inst_sil_cmd_lin.html]
Windows [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.stbpm.doc/topics/inst_sil_cmd_win.html] IBM Business Process Manager Standard AIX [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.sbpm.doc/topics/inst_sil_cmd_aix.html]
Linux [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.sbpm.doc/topics/inst_sil_cmd_lin.html]
Solaris [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.sbpm.doc/topics/inst_sil_cmd_sol.html]
Windows [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.sbpm.doc/topics/inst_sil_cmd_win.html] IBM Business Process Manager Advanced AIX [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.ebpm.doc/topics/inst_sil_cmd_aix.html]
Linux [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.ebpm.doc/topics/inst_sil_cmd_lin.html]
Solaris [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.ebpm.doc/topics/inst_sil_cmd_sol.html]
Windows [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.ebpm.doc/topics/inst_sil_cmd_win.html] IBM Business Process Manager Advanced - Process Server AIX [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.ebpmps.doc/topics/inst_sil_cmd_aix.html]
Linux [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.ebpmps.doc/topics/inst_sil_cmd_lin.html]
Solaris [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.ebpmps.doc/topics/inst_sil_cmd_sol.html]
Windows [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.ebpmps.doc/topics/inst_sil_cmd_win.html]

Alternatively, you can use the Interactive Installation and Configuration Guide [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.doc/topics/bpm_roadmap_form.html]and follow the instructions.
Back to top

Upgrading the Process Designer

After you update your Process Center with a fix pack, refresh pack, or interim fix, you must update the Process Designer to the same level. To make the updates, download the Process Designer file again and run the installation. Only the fixes or changes are applied.

About this task
When you install the fix pack, refresh pack, or interim fix, the IBM Process Designer.zip file is updated also. You must download it and install the updated Process Designer to the directory where you already installed Process Designer.

Procedure

 1. Open the Process Center.

 2. Click the IBM Process Designer Download option.

 3. When you are prompted, save the IBM Process Designer.zip file to your file system. This file contains everything that you need to install and run IBM Process Designer. Depending on your network connection, the download might take several minutes to complete.

 4. Extract the contents of the IBM Process Designer.zip file to a temporary directory on your file system.

 5. Open a command window and change to the directory where you extracted the contents of the IBM Process Designer.zip file.

    Important: If you are running Microsoft Windows 7, Windows Vista, or Windows Server 2008, right-click the command prompt and select Run as administrator.

 6. Run one of the following commands to update the Process Designer. Use the same command that you used to install the Process Designer.  * Default location (C:\IBM\ProcessDesigner\v8.5)  * installProcessDesigner_admin.bat
        * installProcessDesigner_nonadmin.bat

     * Different location  * installProcessDesigner_admin.bat install_location
        * installProcessDesigner_nonadmin.bat install_location

       If the location has spaces in the directory name, put the whole location in quotation marks. The following examples show how to install to a different location.  * installProcessDesigner_admin.bat D:\IBM\PD
        * installProcessDesigner_admin.bat "D:\Process Designer\"

Results
IBM Process Designer is updated. Only the fixes or changes are applied. Installation messages are recorded in the %TEMP%\IBMProcessDesignerInstall.log file, where the %TEMP% variable is typically set to C:\Documents and Settings\current_user_name\Local Settings\Temp.

Back to top

Refresh pack install verification

For upgrades of installations with existing profiles, refer to the Identifying profile update errors [http://www.ibm.com/support/docview.wss?uid=swg27042066#identify] section under the Profile upgrade tab for details on verifying the refresh pack installation.

Note: Installation Manager on the Microsoft Windows operating system does not recognize profile update errors. When you upgrade an installation on Windows, you must look at the Identifying profile update errors [http://www.ibm.com/support/docview.wss?uid=swg27042066#identify] section, even if Installation Manager ends with the following message: The packages are updated.
Back to top

Rolling back V8.5 Refresh Pack 5

You can roll back the refresh pack to a previous version by using one of the following options:
Graphical user interface (GUI) of IBM Installation Manager to roll back an installation
Command line interface of IBM Installation Manager for a silent roll back of a refresh pack

Note: The following procedure rolls back only the product binary. Any existing profiles that were upgraded during a refresh pack installation are not rolled back; you must restore the profiles from the backup you took before you upgraded the product. Any new profiles created after the upgrade cannot be reused; you must delete and recreate the profiles after you have completed the rollback process.

Graphical user interface (GUI) of IBM Installation Manager to roll back an installation

 1.  Close all programs that were installed using Installation Manager before rolling back.

 2.  Start Installation Manager. See Installation directories for the product and profile [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.doc/topics/rins_installation_paths.html] for more information on where Installation Manager is installed.

 3.  From the Start page of the Installation Manager, click Roll back to start the Roll back packages wizard.

 4.  On the Roll Back Packages page, from the Package Group Name list, select the package group that contains the packages that you want to roll back and click Next.

 5.  Select the version of the package to which you want to roll back and click Next.

 6.  Read the summary information and click Roll Back to roll back the package.

     When the rollback process completes, a message that confirms the success of the process is displayed near the top of the page.

 7.  Optional: Click View log file to open the log file for the current session in a new window.

 8.  Click Finish to close the wizard.

 9.  Close Installation Manager.

 10. Restore the backed up data from the original version.

Back to top

Command line interface of IBM Installation Manager for a silent rollback of a refresh pack

Installation Manager offers a command-line interface to silently roll back your product installation to the previous version. In the instructions, it is assumed that you completed all of the necessary profile, database, and refresh pack-specific data backup tasks, which are described in Profile upgrade instructions [http://www.ibm.com/support/docview.wss?uid=swg27042066], before you migrated to Version 8.5 Refresh Pack 5. This data is restored after you complete the rollback task.

 1. Use the following command to roll back your IBM Business Process Manager product to V8.5.0.0.

    IM_INSTALL_LOCATION/tools/imcl rollback PACKAGE_IDVERSION-installationDirectory INSTALL_DIR-log LOG_FILE

    Update the following variables for your installation:  * IM_INSTALL_LOCATION
       This variable represents the location where Installation Manager is installed. See Installation directories for the product and profile [http://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.5/com.ibm.wbpm.imuc.doc/topics/rins_installation_paths.html] for more information on Installation Manager default installation directories.

     * PACKAGE_ID
       This variable represents the package ID of the product installed.

     * VERSION
       This variable represents the original version of the product. Rolling back returns your installation to this version. This version will be Version 8.5.0.0. If you have upgraded directly from Version 8.5.0, see the Details for rolling back to Version 8.5.0.0 information.

        * Details for rolling back to Version 8.5.0.0  * IBM Business Process Manager Express
             Package ID: com.ibm.bpm.EXP.v85
             Version: 8.5.0.20130504_0134
           * IBM Business Process Manager Standard
             Package ID: com.ibm.bpm.STD.v85
             Version: 8.5.0.20130504_0135
           * IBM Business Process Manager Advanced
             Package ID: com.ibm.bpm.ADV.v85
             Version: 8.5.0.20120504_0137
           * IBM Business Process Manager Advanced - Process Server
             Package ID: com.ibm.bpm.PS.v85
             Version: 8.5.0.20120504_0137

        * Details for rolling back to Version 8.5.0.1
          IBM Business Process Manager Express
          Package ID: com.ibm.bpm.EXP.v85
          Version: 8.5.1.20131107_1830

          IBM Business Process Manager Standard
          Package ID: com.ibm.bpm.STD.v85
          Version: 8.5.1.20131107_1830

          IBM Business Process Manager Advanced
          Package ID: com.ibm.bpm.ADV.v85
          Version: 8.5.1.20131107_1830

          IBM Business Process Manager Advanced - Process Server
          Package ID: com.ibm.bpm.PS.v85
          Version: 8.5.1.20131107_1830

        * INSTALL_DIR
          This variable represents the installation directory of the product.

        * LOG_FILE
          This variable represents the location and name of the silent log to write.

 2. After updating the command for your environment, run the command from the tools directory under the Installation Manager installation location.

    The following command is an example:

    C:\Program Files (x86)\IBM\Installation Manager\eclipse\tools\imcl rollback com.ibm.bpm.EXP.v85_8.5.1.20131107_1830 -installationDirectory C:\IBM\BPM\v8.5 -log silent_rollback.txt

 3. When the rollback completes, check the log files to ensure that the rollback completed successfully. A success message displays on the command line:

    Rolled back to com.ibm.bpm.EXP.v85_8.5.1.20131107_1830 in the C:\IBM\BPM\v8.5 directory.

 4. Restore the profile and the database backup taken prior to installing Refresh Pack 5.

Back to top

Reference

You can find additional information on any of these topics in the IBM Business Process Manager [http://www.ibm.com/support/knowledgecenter/SSFPJS/welcome] product documentation.

For further information on the update strategy or obtaining updates, see the support page for your product.

IBM Business Process Manager Express Support page [http://www.ibm.com/support/entry/portal/Overview/Software/WebSphere/IBM_Business_Process_Manager_Express]
IBM Business Process Manager Standard Support page [http://www.ibm.com/support/entry/portal/Overview/Software/WebSphere/IBM_Business_Process_Manager_Standard]
IBM Business Process Manager Advanced Support page [http://www.ibm.com/support/entry/portal/Overview/Software/WebSphere/IBM_Business_Process_Manager_Advanced]
IBM Business Process Manager Advanced Process Server Support page [http://www.ibm.com/support/entry/portal/Overview/Software/WebSphere/IBM_Business_Process_Manager_Advanced]

Back to top

Trademarks and service marks:
For trademark attribution, visit the IBM Terms of Use [http://www.ibm.com/legal] Web site.
Back to top

ORIGINAL PUBLICATION DATE
 2013/11/15

Cross reference information Segment Product Component Platform Version Edition Business Integration IBM Business Process Manager Standard Installation / Configuration AIX, Linux, Linux zSeries, Solaris, Windows 8.5.5 Business Integration IBM Business Process Manager Express Installation / Configuration Linux, Windows 8.5.5 PRODUCT ALIAS/SYNONYM
 BPM

Question:
Upgrading from ibm bpm 8.5 to ibm bpm 8.5.5

Hi there,

I was wondering if it is possible to upgrade from ibm bpm 8.5 to 8.5.5 ? is this possible? please suggest. thanks

Answer: V8.5 Refresh Pack 5 is intended to be used on IBM Business Process Manager Express, IBM Business Process Manager Standard, IBM Business Process Manager Advanced, and IBM Business Process Manager Advanced - Process Server installations.


IBM Dataserver services changing from Healthy to Vulnerable - United States SIQ TECHNOTE (FAQ)

QUESTION
 Why does the Dataserver service change from healthy to Vulnerable after logging into appstack?

CAUSE
Memory allocated was not the supported number

ANSWER

This could be due to amount of Memory allocated to the dataserver.

 1. Login to the Dataserver
 2. Click on Administration > Dashboard tab
 3. Review the Application status and make sure it is green
 4. Click on Controller Link
 5. Review and confirm that all services are running fine
 6. If needed, make changes to memory

Question: Why does the Dataserver service change from Healthy to Vulnerable after logging into StoredIQ Application Stack? Why does the Dataserver service change from Healthy to Vulnerable after logging into StoredIQ Application Stack?

Answer: This could be due to amount of Memory allocated to the dataserver.


IBM Server Error Message when running BIRT Reports after upgrading to Atlas 6.0.3.3 - United States  TECHNOTE (FAQ)

QUESTION
 Why do we get server error message when running BIRT reports after upgrading to Atlas 6.0.3.3?

CAUSE
This happens when the BIRT Reports is running in Standalone mode and happens due to a new configuration - report.standalone.userid

ANSWER

 1. Navigate to Atlas Properties Folder
 2. Edit AtlasReportConfig.properties
 3. Uncomment the property #report.standalone.userid=1
 4. Save the change
 5. Restart both Atlas and Atlas Reports application server instances

Question: Why do we get server error message when running BIRT reports after upgrading to Atlas 6.0.3.3? Why do we get server error message when running BIRT reports after upgrading to Atlas 6.0.3.3?

Answer: This happens when the BIRT Reports is running in Standalone mode and happens due to a new configuration - report.standalone.userid


IBM IA9Z:  WebSphere Message Broker - Job Execution Node - United States ia9z; Job Execution; Batch files; Shell scripts DOWNLOADABLE FILES

ABSTRACT
 WebSphere Message Broker – Job Execution Node

DOWNLOAD DESCRIPTION
You might need to invoke operating system commands, windows batch files, or Unix shell scripts (henceforth referred to as jobs) from within the message flow. You might also want to schedule jobs at a specific time/interval/frequency.

The JobExecutionNode, a Java-based plugin, allows you to execute operating system commands, and invoke jobs in the form of batch/shell scripts from within the message flow. The jobs can be specified on the node property or as a part of the input message.

Possible Uses

 * You can execute operating system commands, and invoke jobs in the form of batch/shell scripts from within the message flow.
 * You can schedule the tasks at a specific time (using Timer nodes) and execute them from the Message flows.
 * You can enrich the message by using the result/output of the job execution.

New in this Release
• Works with IIB V10.

Details
Authors: Amar Shah, Shravan Kudikala, ISL-Messaging
Category: 2
Released: 26Oct07
Last Updated: 09Dec15
Current SupportPac Version: 1.5
»Please note that the version number shown in the right-hand pane is the version of the MQ or WBI product that this SupportPac applies to. The date is the last webpage refresh.

To view the complete portfolio of WebSphere MQ SupportPacs please visit the WebSphere MQ SupportPacs homepage. [http://www-306.ibm.com/software/integration/support/supportpacs] PREREQUISITES
IBM Integration Bus - V9 or higher
WebSphere Message Broker – V6.1 or higher.

INSTALLATION INSTRUCTIONS
Unzip the SupportPac and read the user manual. Details are inside the user manual guide.

URL LANGUAGE SIZE(Bytes) ia9z.pdf [ftp://public.dhe.ibm.com/software/integration/support/supportpacs/individual/ia9z.pdf] US English 402008
DOWNLOAD PACKAGE

Download RELEASE DATE LANGUAGE SIZE(Bytes) Download Options ia9z.zip 26 Nov 2013 US English 626688 HTTP [http://www14.software.ibm.com/cgi-bin/weblap/lap.pl?popup=Y&li_formnum=L-TMAN-785DAH&accepted_url=ftp://public.dhe.ibm.com/software/integration/support/supportpacs/individual/ia9z.zip]
TECHNICAL SUPPORT
 Category 2 SupportPacs are provided in good faith and AS-IS. There is no warranty or further service implied or committed and any supplied sample code is not supported via IBM product service channels.

You may submit a question and return email address using the 'rate this page' below, but a response is not guaranteed.

Please read the license information contained within the zip file of this SupportPac to determine if you want to use it.

Cross reference information Segment Product Component Platform Version Edition Business Integration IBM Integration Bus Standard 9.0

Question: Job Execution Node for IIB V10 I'm looking for a way in IIB V10 to execute/invoke scripts or jobs on different operating systems like windows or System i (AS400). After a little research i found out that there is a Job Execution Node for the IIB V9, which seems to cover the requirements. Is there a Job Execution Node for the IIB V10, or an other appropriate node for the requirements?

Answer: The JobExecutionNode, a Java-based plugin, allows you to execute operating system commands, and invoke jobs in the form of batch/shell scripts from within the message flow. The jobs can be specified on the node property or as a part of the input message.


IBM BMXAA4198E - The GL attribute TLOAMNEWGLACCOUNT on object {1} requires an organization. - United States TAPEINTEGRATION; asset; MIF TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 When importing ASSET using the Integration Framework you receive the following error after applying an IFIX or FIXPACK:

BMXAA4198E - The GL attribute TLOAMNEWGLACCOUNT on object {1} requires an organization. Specify a value in the Organization field.

CAUSE
This error is occurring due to a fix made for APAR IV67500 and included in a Maximo 7.5.0.6 or later ifix. The fix requires that the neworgid is included in the message.

DIAGNOSING THE PROBLEM
You will see a stack trace similar to the following in the system out log:

psdi.util.MXAccessException: BMXAA4198E - The GL attribute TLOAMNEWGLACCOUNT on object {1} requires an organization. Specify a value in the Organization field.
at psdi.mbo.Mbo.getOrgForGL(Mbo.java:6976)
at psdi.mbo.MboGLValue._setValue(MboGLValue.java:59)
at psdi.mbo.MboValue.setValue(MboValue.java:1141)
at psdi.mbo.Mbo.setValue(Mbo.java:2175)
at
psdi.app.asset.FldMoveModifyAssetNewGLAccount.initValue(FldMoveModifyAssetNewGLAccount.java:53)
at psdi.mbo.MboValue.initValue(MboValue.java:404)
at psdi.mbo.MboValue.isNull(MboValue.java:507)
at psdi.mbo.Mbo.isNull(Mbo.java:2839)
at
psdi.iface.app.asset.MaxAssetProcess.setAdditionalData(MaxAssetProcess.java:85)
at
psdi.iface.mos.MosProcessImpl.setMainMaximoTable(MosProcessImpl.java:767
)
...

RESOLVING THE PROBLEM
Add the following field or tag to your inbound message. For example, if you are sending XML:

<NEWORGID>xxx</NEWORGID>

where xxx is the ORGID value.

Make sure that NEWORGID is included on the object structure.

Go To Integration > Object Structures and query the object structure.

From the Select Action menu drop down, select Exclude/Include Fields and select the Non-Persistent Fields tab. Include NEWORGID.

Question:
Importing Asset GL Errors  When importing or syncing with assets, I receive the following error for the glaccount.

Internal Server Error
Error 500: nested exception is: psdi.util.MXAccessException: BMXAA4198E - The GL attribute TLOAMNEWGLACCOUNT on object {1} requires an organization. Specify a value in the Organization field.

Answer:
Add the following field or tag to your inbound message. For example, if you are sending XML:

<NEWORGID>xxx</NEWORGID>

where xxx is the ORGID value.

Make sure that NEWORGID is included on the object structure.

Go To Integration > Object Structures and query the object structure.

From the Select Action menu drop down, select Exclude/Include Fields and select the Non-Persistent Fields tab. Include NEWORGID.


IBM Clarification of WebSphere Message Broker support of Resource Registry with WebSphere Transformation Extender for Message Broker - United States  TECHNOTE (FAQ)

QUESTION
 Does IBM® WebSphere® Message Broker support a Resource Registry file from IBM WebSphere Transformation Extender for Message Broker?

ANSWER
WebSphere Transformation Extender maps that are called from WebSphere Message Broker can use the WebSphere Transformation Extender Resource Registry. WebSphere Message Broker itself does not provide any facility for working with resource registries in areas of the message flow outside of the WebSphere Transformation Extender plugin.

In the WebSphere Transformation Extender for Message Broker documentation, the following sentence in the topic "Setting resource registry on execution groups:"

Configure WebSphere Message Broker to use the WebSphere Transformation Extender Resource Registry by setting the resource configuration (.mrc) file on execution groups.

Should read:

Configure WebSphere Transformation Extender for Message Broker to use the WebSphere Transformation Extender Resource Registry by setting the resource configuration (.mrc) file on the WebSphere Message Broker execution groups.

Question:
Resource registry with IIB

Hi Team,

I do had a scenario to be accomplished in IIB, in which one input should be passed from MQ and the other should be passed from FILE(for this i have been using Resource Registry Concept) and in order to specify mrc file i have modified dtx.ini file which is located in Integration server Insatllation directory but when the flow has been deployed an exception is being raised with the error message stating "Source not found" .

FYI - When i tried the RR from Design Studio it is working absolutely fine.

Is there something i need to configure/modify so that the mrc file will be accessible to the map in IIB flow as well.

Answer: WebSphere Transformation Extender maps that are called from WebSphere Message Broker can use the WebSphere Transformation Extender Resource Registry. WebSphere Message Broker itself does not provide any facility for working with resource registries in areas of the message flow outside of the WebSphere Transformation Extender plugin.


IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM OS Images for Red Hat Linux Systems and AIX (CVE-2015-0410 and CVE-2014-6593) - United States  SECURITY BULLETIN

SUMMARY
 There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition Version 6 and 7 that are used by IBM OS Images for Red Hat Linux Systems and AIX. These issues were disclosed as part of the IBM Java SDK updates in January 2015.

VULNERABILITY DETAILS
CVEID: CVE-2015-0410 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0410]
DESCRIPTION: An unspecified vulnerability related to the Security component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100151 [https://exchange.xforce.ibmcloud.com/vulnerabilities/100151] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-6593 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6593]
DESCRIPTION: An unspecified vulnerability related to the JSSE component has partial confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100153 [https://exchange.xforce.ibmcloud.com/vulnerabilities/100153] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)

AFFECTED PRODUCTS AND VERSIONS
IBM OS Image for Red Hat Linux Systems 2.0.0.1 and earlier.
IBM OS Image for AIX 2.0.0.1 and earlier.

REMEDIATION/FIXES
The deployed Red Hat Linux-based and AIX virtual machines on IBM PureApplication Systems types are affected. The solution is to apply the following IBM PureApplication System fix to the deployed virtual machines.

Java Update for Linux
http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=PureSystems&product=ibm/WebSphere/PureApplication+System&release=All&platform=All&function=fixId&fixids=+Java_Update_Linux_2++&includeSupersedes=0 [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=PureSystems&product=ibm/WebSphere/PureApplication+System&release=All&platform=All&function=fixId&fixids=+Java_Update_Linux_2++&includeSupersedes=0]

Java Update for AIX
http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=PureSystems&product=ibm/WebSphere/PureApplication+System&release=All&platform=All&function=fixId&fixids=+Java_Update_AIX_2++&includeSupersedes=0 [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=PureSystems&product=ibm/WebSphere/PureApplication+System&release=All&platform=All&function=fixId&fixids=+Java_Update_AIX_2++&includeSupersedes=0]

 1. Import the fix into the Emergency Fix catalogue.
 2. For deployed instances, apply this emergency fix on the VM. The IBM Java SDKwill be upgraded to IBM Java JDK 7.0 SR8 FP10 interim fix and IBM Java JDK 6.0 SR16 FP3 interim fix
 3. Restart the deployed instance after the fix is applied.

You should verify applying this fix does not cause any compatibility issues. WORKAROUNDS AND MITIGATIONS
None

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v2 Guide [http://www.first.org/cvss/v2/guide]
On-line Calculator v2 [http://nvd.nist.gov/CVSS-v2-Calculator]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

ACKNOWLEDGEMENT
None

CHANGE HISTORY
 23 July 2015: Original Version Published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Question: Help with Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM OS Images for Red Hat Linux Systems and AIX (CVE-2015-0410 and CVE-2014-6593) I need to understand details regarding "Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM OS Images for Red Hat Linux Systems and AIX (CVE-2015-0410 and CVE-2014-6593)" Where can I find this information?

Answer:
CVEID: CVE-2015-0410
DESCRIPTION: An unspecified vulnerability related to the Security component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100151 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-6593
DESCRIPTION: An unspecified vulnerability related to the JSSE component has partial confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100153 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)


IBM How to enable Baselining in your monitored application. - United States tema enable baselining Unknown application health status CAMADALL CAMADINST TECHNOTE (FAQ)

THIS DOCUMENT APPLIES ONLY TO THE FOLLOWING LANGUAGE VERSION(S):
 US English

QUESTION
 Steps to enable Baselining in your monitored application.

ANSWER
The health of the monitored application is calculated against an internally stored baseline threshold. The baselining of the application is a process that uses a pre-defined mathematical and statistical method to automatically calculate a threshold based on response time information typically collected over a period of time (few days to few weeks.)

By default baselining gets enabled with a situation WasAppDiscoverd. This situation is enabled by default and will discover new applications then run a take action to start the baselining. So if this situation is not enabled then you should enable it and assign to the ITCAM App Server managing system list.

You want to do baselining with normal or typical load on the server over a period of few days to few weeks, or even few months. The performance of the application under this load is considered good (you will see "Good"" in the Application Health views) and deviation from this performance indicates degrading health ("Bad" or "Fair" in the Application Health views) of the monitored application.

To start baselining for your application server, please follow these steps:

(Note 1: in this example, I've used a WebSphere-based application but you can also do the same for any application on your J2EE agent also.)

(Note 2: Before beginning baselining, make sure you have typical or normal load on the server to set the baselining threshold values.)

1. Login to your TEPS, select Application Health, right-click on it, go to Workspace and select Application Registry. Look at the panels on the right and observe the baselining columns. If they're blank, your baselining has not been started.

2. Next select Application Health, right-click on it, go to Workspace and select Application Health status. If you see Unknown, then you know the baselining has not started or not been calculated.

3. High-lite your application, select the small yellow chain link in the first unnamed column and select Application Configuration Details. See screenshot here:

[/support/docview.wss?uid=swg21653905&aid=1] [/support/docview.wss?uid=swg21653905&aid=1]

4. In the bottom panel on the right select the line that says All and high-lite it. Then right-click it, select Take Action and Select. In the pull-down, select Start_Baselining and enter the Period (2 days), Update_Interval (every 2 hours), and Run_Clean set to 1 (clean start.) If you wish, you can change these values to whatever you want.

See screenshots here:
[/support/docview.wss?uid=swg21653905&aid=2] [/support/docview.wss?uid=swg21653905&aid=2]
[/support/docview.wss?uid=swg21653905&aid=3]
Hit OK twice and you should get a Command completed successfully message. (Note: If you get a Baselining_Already_Active message in the pop-up window, then you should do another Take Action and Stop_Baselining first if you want to do the baselining again.)

Once you have the baselining active, let it run for the period of time with typical load on the server. After the baselining is complete, the Unknown values in the Application Health should now change to Good or Fair or Bad depending on threshold values.

Cross reference information Segment Product Component Platform Version Edition Systems and Asset Management Tivoli Composite Application Manager for Web Resources ITCAM for Web Resources (J2EE TEMA) AIX, HP-UX, Linux, Solaris, Windows, Solaris Opteron 6.1, 6.2 Advanced
PRODUCT ALIAS/SYNONYM
 ITCAM ITCAM4AD ITCAMfAD TEMA ITCAM for Web Resources

Question: What is the meaning of value "unknown" for ITCAM WAS Application Status attribute? What is the meaning of value "unknown" for ITCAM WAS Application Status attribute?

Answer: By default baselining gets enabled with a situation WasAppDiscoverd. This situation is enabled by default and will discover new applications then run a take action to start the baselining. So if this situation is not enabled then you should enable it and assign to the ITCAM App Server managing system list.


IBM WebSphere DataPower M/T 9235 appliance might incorrectly report failure of both power supplies - United States  TECHNOTE (FAQ)

QUESTION
 The IBM WebSphere DataPower M/T 9235 appliance might incorrectly report the failure of both power supplies. This message is not reported on all appliances and can occur rarely in the field.

ANSWER
The following message would be present in the DataPower logs:

System power supply #2 has failed.

or logging event code:

0x80400022 System power supply #2

The problem can be confirmed by issuing the following commands on the appliance CLI:

co
test hardware
exit

The following output from the test hardware command confirms this problem:

[failure] Power supply '1' has no AC input power, or is not present.
[failure] Power supply '2' has no AC input power, or is not present.

Other results in the test hardware command might also show incorrect values.

This problem does not affect the operation of the appliance other than the continuous reporting power supply failure message.

To confirm the power supplies are working normally you may check the LED status on the power supplies. If the LED's are green the power supplies are working normally.

To recover from the false errors perform a reboot of the appliance:

From the WebGUI:

Control Panel → System Control → In the “Shutdown” section choose “Reboot System” then click “Shutdown”

From the CLI:

top

shutdown reboot

y

This problem is caused by a highly intermittent error that may allow the sensor reading mechanism to get into a bad state. This bad state then generates the false error messages. In most cases, a reboot of the appliance will reset the sensors and no additional errors are logged. The highly intermittent error rarely occurs again on the same appliance

If the issue reoccurs on the same appliance contact IBM DataPower support [http://www.ibm.com/support/docview.wss?uid=swg21236322] with the following information:

1) How many times have you seen the issue on the same appliance?

2) Gather the outputs for the following CLI commands:
show clock
show version
show ipmi
show sensors-other
config
service show
test hardware

Question:
I am receiving AC power supply failures on my DataPower 9235 appliance. How can I resolve this?

I am observing the following errors on my DataPower 9235 device:

[failure] Power supply '1' has no AC input power, or is not present. [failure] Power supply '2' has no AC input power, or is not present.
Do i need to replace the power supplies?

Answer: This problem is caused by a highly intermittent error that may allow the sensor reading mechanism to get into a bad state. This bad state then generates the false error messages.


IBM Runstats may update unexpected HIGH2KEY and LOW2KEY statistic values which may cause SQL1227N - United States  TECHNOTE (FAQ)

QUESTION
 Why is SQL1227N returned when replay db2look output?

CAUSE
It is an known limitation of current DB2 V9.7 and above versions' runstats.

ANSWER
If we run an example scenario below, at the end of script "db2 -tvf db2_SAMPLE.sql"

gets SQL1227N.
--- repro.sh ---
#!/bin/sh

db2 -v "drop db sample"
db2 -v "create db sample"
db2 -v "connect to sample"
db2 -v "drop table db2inst1.tab1"
db2 -v "create table db2inst1.tab1 ( col1 varchar(10) )"
db2 -v "insert into db2inst1.tab1 values (NULL),(' '),(' '),(' ')"
db2 -v "runstats on table db2inst1.tab1"
db2 -v "terminate"
db2 -v "connect to sample"
db2look -d sample -a -e -m -o db_SAMPLE.sql

db2 -v terminate
db2 -v "drop db sample"
db2 -v "create db sample"
db2 -v "connect to sample"
db2 -tvf db_SAMPLE.sql | tee test.log
# replay db2look output and gets SQL1227N at this point
db2 -v terminate
----------

Here is the SQL1227N message:
-----
UPDATE SYSSTAT.COLUMNS SET COLCARD=4, NUMNULLS=1, SUB_COUNT=-1, SUB_DELIM_LENGTH=-1,
AVGCOLLENCHAR=7, HIGH2KEY='', LOW2KEY=' ', AVGCOLLEN=12 WHERE COLNAME = 'COL1'
AND TABNAME = 'TAB1' AND TABSCHEMA = 'DB2INST1'
DB21034E The command was processed as an SQL statement because it was not a
valid Command Line Processor command. During SQL processing it returned:
SQL1227N The catalog statistic "" for column "HIGH2KEY" is out of range for
its target column, has an invalid format, or is inconsistent in relation to
some other statistic. Reason Code = "3". SQLSTATE=23521
-----
As above, UPDATE SYSSTAT.COLUMNS statement gets SQL1227N at col1 varchar(10).
It is caused by runstats, writes an unexpected HIGH2KEY and LOW2KEY statistic values.

Here is work arounds:

Work around #1
1. $ db2set DB2_STATISTICS=USCC:0
** this variable is available for V10.1 FP4 and above.
2. $ db2 terminate
3. $ db2start
4. $ repro.sh

Work around #2
1. Edit SQO1227N causing UPDATE statements' COLCARD=4 to 3 in db_SAMPLE.sql file.
2. Replay by running "db2 -tvf db_SAMPLE.sql"

Work around #3
1. Do not insert/import space(s) data, such as " ", " ".

Note:
This behavior might be changed without notice in the future. We can confirm whether this technote
is valid or not by following sample scenario above.
Please contact your Sales Rep to submit a potential design change towards a future release.
Or please open a ticket, Request For Enhancement at https://www.ibm.com/developerworks/rfe/ [https://www.ibm.com/developerworks/rfe/]

RELATED INFORMATION
 RUNSTATS command [http://www-01.ibm.com/support/knowledgecenter/SSEPGG_10.5.0/com.ibm.db2.luw.admin.cmd.doc/doc/r0001980.html?lang=en]

Question:
Why get SQL1227N when replay db2look output on DB2 V9.7 FP11? Why get below SQL1227N when replay db2look output on DB2 V9.7 FP11?

     -----
     UPDATE SYSSTAT.COLUMNS SET COLCARD=4, NUMNULLS=1, SUB_COUNT=-1, SUB_DELIM_LENGTH=-1,
     AVGCOLLENCHAR=7, HIGH2KEY='', LOW2KEY='        ', AVGCOLLEN=12 WHERE COLNAME = 'COL1'
     AND TABNAME = 'TAB1' AND TABSCHEMA = 'DB2INST1'
     DB21034E  The command was processed as an SQL statement because it was not a
     valid Command Line Processor command.  During SQL processing it returned:
     SQL1227N  The catalog statistic "" for column "HIGH2KEY" is out of range for
     its target column, has an invalid format, or is inconsistent in relation to
     some other statistic. Reason Code = "3".  SQLSTATE=23521
     -----

Answer: It is an known limitation of current DB2 V9.7 and above versions' runstats.


IBM NormalizeCCO merging lines with IBM Datacap Taskmaster Capture - United States normalizecco; merge lines; recognition TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 After running NormalizeCCO, words on separate lines are merged into a single line of text when using IBM Datacap Taskmaster Capture.

SYMPTOM
In the following image, Word 1 and Word 2 are on separate lines, but after NormalizeCCO is run may show in a single line as Word Word 1 2.

[/support/docview.wss?uid=swg21701910&aid=1]

CAUSE
When text is not cleanly printed in lines, such as when the font varies or the text is vertically offset, Datacap may not always be able to locate text when loading field values. The NormalizeCCO goes through the CCO file, and cleans up all the entries so they appear in regular lines. For most images this improves ultimate recognition results, but for some complex images, NormalizeCCO cannot determine where to separate the lines and merges all words into a single line.

RESOLVING THE PROBLEM
Add the following action prior to NormalizeCCO.

 *
 *

The first parameter is the percentage of a line that two words must be offset to be considered as separate lines. If the value is not set, the default is 50. In the example, if two words are vertically offset by more than 35% of the height of the words, then they are considered to be on separate lines. Lower values are more likely to split words into separate lines. Higher values are more likely to merge words into a single line.

Cross reference information Segment Product Component Platform Version Edition Enterprise Content Management Datacap Not Applicable Windows 9.0.1, 9.0.0

Question: Why is OCR is putting multiple lines on one line? I am running an APT application, and multiple detail lines are getting put on a single line within my .TXT file.  Is there something I can do about this?

Answer:
Add the following action prior to NormalizeCCO.

 *
 *

The first parameter is the percentage of a line that two words must be offset to be considered as separate lines. If the value is not set, the default is 50. In the example, if two words are vertically offset by more than 35% of the height of the words, then they are considered to be on separate lines. Lower values are more likely to split words into separate lines. Higher values are more likely to merge words into a single line.


IBM PI47826: VMM DOES NOT CLEAR THE CACHE IF CLEARENTITY MODE IS USED. - United States   FIXES ARE AVAILABLE
8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9 [http://www-01.ibm.com/support/docview.wss?uid=swg24041819]
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10 [http://www-01.ibm.com/support/docview.wss?uid=swg24042150]
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11 [http://www-01.ibm.com/support/docview.wss?uid=swg24043005]
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13 [http://www-01.ibm.com/support/docview.wss?uid=swg24042746]
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12 [http://www-01.ibm.com/support/docview.wss?uid=swg24043844]
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14 [http://www-01.ibm.com/support/docview.wss?uid=swg24044096]
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13 [http://www-01.ibm.com/support/docview.wss?uid=swg24044479]
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15 [http://www-01.ibm.com/support/docview.wss?uid=swg24044734]

SUBSCRIBE
You can track all active APARs for this component.

APAR STATUS
 * CLOSED AS PROGRAM ERROR.

ERROR DESCRIPTION
 *  If base entry and name in repository is different and
   clearCache functionality is used with clearEntity mode then
   virtual member manager (VMM) still looks in the cache and gets
   the entity from the cache instead of fetching it from the LDAP
   server.

LOCAL FIX
 *  test fix

PROBLEM SUMMARY
 *  ****************************************************************
   * USERS AFFECTED:  All users of IBM WebSphere Application      *
   *                  Server V8.0 and V8.5 virtual member         *
   *                  manager (VMM)                               *
   ****************************************************************
   * PROBLEM DESCRIPTION: Clear cache does not work if            *
   *                      clearEntity                             *
   *                      mode is used.                           *
   ****************************************************************
   * RECOMMENDATION:                                              *
   ****************************************************************
   LDAP Clear cache functionality of VMM does not work when using
   clearEntity mode. Problems occur only if there is a different
   base entry used than the name in the repository entry.

PROBLEM CONCLUSION
 *  This APAR fixes the issue. It clears the cache properly even if
   base entry is different than name in repository.

   The fix for this APAR is currently targeted for inclusion in
   fix packs 8.0.0.13 and 8.5.5.9.  Please refer to the
   Recommended Updates page for delivery information:
   http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980 [http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980]

TEMPORARY FIX

COMMENTS

APAR INFORMATION
 * APAR NUMBER
   PI47826

 * REPORTED COMPONENT NAME
   WEBS APP SERV N

 * REPORTED COMPONENT ID
   5724H8800

 * REPORTED RELEASE
   800

 * STATUS
   CLOSED PER

 * PE
   NoPE

 * HIPER
   NoHIPER

 * SPECIAL ATTENTION
   NoSpecatt / Xsystem

 * SUBMITTED DATE
   2015-08-28

 * CLOSED DATE
   2015-12-09

 * LAST MODIFIED DATE
   2015-12-09

 * APAR IS SYSROUTED FROM ONE OR MORE OF THE FOLLOWING:

 * APAR IS SYSROUTED TO ONE OR MORE OF THE FOLLOWING:

FIX INFORMATION
 * FIXED COMPONENT NAME
   WEBS APP SERV N

 * FIXED COMPONENT ID
   5724H8800

APPLICABLE COMPONENT LEVELS
 * R800 PSY
   UP

 * R850 PSY
   UP

Question: Why is the reload() not clearing the attribute cache so I can see my newly updated LDAP data in real time? Why is the reload() not clearing the attribute cache so I can see my newly updated LDAP data in real time?

Answer:
This APAR fixes the issue. It clears the cache properly even if
   base entry is different than name in repository.

   The fix for this APAR is currently targeted for inclusion in
   fix packs 8.0.0.13 and 8.5.5.9.  Please refer to the
   Recommended Updates page for delivery information:
   http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980


IBM Late breaking updates to DataPower 7.5 documentation - United States  NEWS

ABSTRACT

The version 7.5 documentation for IBM DataPower Gateway is not the latest available information. This document covers late breaking updates that are not in IBM Knowledge Center.

Last updated, October 2017.

CONTENT
The late breaking updates in this document apply to DataPower Gateway version 7.5 documentation.

To access specific updates, click the appropriate link:  * Upgrade
 *
 * Installation
 *
 * GatewayScript
 *
 * File management
 *
 * Monitors

To view the change history of this document, see Change history

The corrections in the following sections apply to DataPower Gateway version 7.5 in IBM Knowledge Center.

Upgrade  *
 *  Disabled diffie-hellman-group-exchange-sha1 and diffie-hellman-group1-sha1 algorithms by default. Disabled MD5-based MAC algorithms. Limited DH-GEX to 4096 bits for Cisco devices.
 *
 *
 * enable-legacy-kex yes
 *
 *  The enable-legacy-kex command for the SSH server profile in available in 7.5.2.0. The enable-legacy-kex command for the SSH client profile is available in 7.5.2.7.
 *
 *
 *  Default cipher suites  * chacha20-poly1305@openssh.com (CHACHA20-POLY1305_AT_OPENSSH.COM)
    *
    * aes128-ctr (AES128-CTR)
    *
    * aes192-ctr (AES192-CTR)
    *
    * aes256-ctr (AES256-CTR)
    *
    * aes128-gcm@openssh.com (AES128-GCM_AT_OPENSSH.COM)
    *
    * aes256-gcm@openssh.com (AES256-GCM_AT_OPENSSH.COM)
    *
    * arcfour256 (ARCFOUR256)
    *
    * arcfour128 (ARCFOUR128)
    *
    * aes128-cbc (AES128-CBC)
    *
    * 3des-cbc (3DES-CBC)
    *
    * blowfish-cbc (BLOWFISH-CBC)
    *
    * cast128-cbc (CAST128-CBC)
    *
    * aes192-cbc (AES192-CBC)
    *
    * aes256-cbc (AES256-CBC)
    *
    * arcfour (ARCFOUR)
    *
    * rijndael-cbc@lysator.liu.se (RIJNDAEL-CBC_AT_LYSATOR.LIU.SE)

   Default KEX algorithms  * curve25519-sha256@libssh.org
    *
    * ecdh-sha2-nistp256
    *
    * ecdh-sha2-nistp384
    *
    * ecdh-sha2-nistp521
    *
    * diffie-hellman-group-exchange-sha256
    *
    * diffie-hellman-group14-sha1

   Default MAC algorithms  * umac-64-etm@openssh.com
    *
    * umac-128-etm@openssh.com
    *
    * hmac-sha2-256-etm@openssh.com
    *
    * hmac-sha2-512-etm@openssh.com
    *
    * hmac-sha1-etm@openssh.com
    *
    * umac-64@openssh.com
    *
    * umac-128@openssh.com
    *
    * hmac-sha2-256
    *
    * hmac-sha2-512
    *
    * hmac-sha1

 *
 *
 *  The SSH client always initiates the banner exchange. During the SSH2 banner exchange, use CR+LF termination for the banner. The SSH client ignores any message from the SSH server until the banner exchange.

Back to top

Installation  *
 * show other-sensors
 *
 * show sensors-other
 *

Back to top

GatewayScript  *
 * clear gatewayscript-cache path
 *

Back to top

File management  *
 *  isamwebroot local policyframework

Back to top

Monitors  *
 * type
 *
 * block
 *
 * shape
 *
 * type command
 *

Back to top

Change history
Last modified: 30 October 2017.  * 30 October 2017: Added information about nonexisting block keyword for Message Filter Action type command.
 * 19 October 2017: Added information about which directories you can create and remove subdirectories.
 * 19 July 2016: Added data about the wrong command troubleshooting command in the installation documentation.
 * 17 June 2016: Added data about the undocumented Global command.
 * 22 March 2016: Created for 7.5.

Back to top

Question: Why SSH connections fail after upgrade to v7.5.2 and above? Why SSH connections fail after upgrade to v7.5.2 and above? The same configuration works on v7.2.

Answer: Disabled diffie-hellman-group-exchange-sha1 and diffie-hellman-group1-sha1 algorithms by default. Disabled MD5-based MAC algorithms. Limited DH-GEX to 4096 bits for Cisco devices.


IBM Information Server QualityStage Match Designer Database creation - United States MD Match Designer Matching Match InformationServer QualityStage TECHNOTE (FAQ)

QUESTION
 How do I configure the Match Designer Database in Information Server?

ANSWER
This Technote outlines the following procedures.

 1. Prerequisites
 2. What is the Match Database’s purpose?
 3. Setting the database up.
 4. Configuring the Match Designer for use with the Database.
 5. On going maintenance

Prerequisites
The following must exist before using the Match Designer functionality.  1. Match Specification built for use in match designer.
 2. Create a data set that contains the data you will run the match analysis on.
 3. Create a corresponding frequency data set to be used in the match analysis.
 4. DSN for local PC
 5. Create Database in which to perform the Match analysis processing.
    a) Sizing of Database
    b) Character sets required
    c) Permission's for users

Additional information is also available with in the WebSphere QualityStage User Guide.

What it’s the Match Database’s purpose?  1. The results Database is used to test the match specifications (logic) designed for use in match jobs.
 2. This functionality enables the user to get a baseline of how good the match criteria are, based on the match logic developed for use in the application.
 3. The results Database stores statistics and match results based on your data. For Example: How many matches, duplicates, and unmatched records.
 4. This functionality allows developers to change matching logic on the fly and retest within minutes.

 * There is nothing from this Database that is used in production runs so it should never be created on or moved to a production box.
 * The Match Designer is to be used for development purposes only with a "subset" of the full volume data. If additional match modifications are required continue to use a subset of data not conduct testing with full volume data.
 * Determining the subset size of data to use in the Match Designer will vary depending on the clients environment and resources. Each client should run several iterations to determine the optimal subset to utilize in the Match Designer step.
 * To obtain the most accurate matching thresholds a full volume run should be performed in the DataStage Designer.

Creating the Database  1. You should start from an empty Database; using the default XMETA Database is not recommended because it can become corrupt.
 2. There are certain requirements on how the Database is to be created.
    a) If Oracle: CHARACTERSET should be set to AL32UTF
    b) If SQL: default is fine.
    c) If DB2: create as codepage UTF-8 and page size 32K
    d) Permission’s - Each user has to have the ability to create tables, write and read rights in the DB.
    e) The minimum DB space required will be calculated as follows = Number of Passes in match specification (X) Number of Input Records (X) Input Record Length (+) 100 filler.
    f) If this is a distributed installation, you need to have ODBC defined in your client and on the server. They must have the same name.

Configuring the Match Designer for use with the Database  1.  Via the DataStage Designer navigate to the your match specification to work with
 2.  Double click and a window will appear indicating:
     “The ODBC Data Source Name (xxxxxxx) currently specified for this Match could not be found. Please create a DSN by this name or run a Test Environment Update to configure a different DSN for this Specification.”
 3.  Select the “OK” button
 4.  Select option “Configure Specification”
 5.  From drop down select “Test Environment”
 6.  For “Sample Information” navigate to the location of your data set(s) created for analysis.
 7.  Under “Frequency Information” navigate to the location of your frequency data set(s) created for use.
 8.  Section “Test Results Database” fill the following information in.
     a. Select the DSN created for the will allow the connection to the Database.
     b. Enter user name required
     c. Password required
     d. Test Connection
     e. Configuration File Location; these are the nodes located in your environment for use. Please make sure this matches the location of where the data sets reside on the server.
 9.  Once connection is established hit the “Update” button. This will populate the Database with the required fields (not data) to populate when you perform the test specification.
 10. The final step is to perform the Test All Passes. Please note this make take a few moments depending on the size of the files used.

Ongoing Maintenance  1. For each new run, results are cleared and rewritten to the DB.
 2. Each user should have their own respective Databases to avoid rewriting over previous results.
 3. There are separate tables holding results for each design. And from one user it is no problem to use a single Database and multiple designs.
 4. Per the recommendation above in "Creating the Database" this database should not be your XMETA database. If you used the XMETA DO NOT RUN THIS STEP. When you are done testing you can drop the DB altogether.

Question:
Can we create Match design specification db in xmeta Could you please let me know if we can create schema for Match design
specification database in xmeta db.

Answer: You should start from an empty Database; using the default XMETA Database is not recommended because it can become corrupt.


IBM DataType incorrect on Secondary - United States netcool; impact; netcool/impact; nci; data; type; datatype; .type; replication; cluster; sync; error; 500; mark; invalid TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 The DataType is not being correctly replicated across the ImpactServer Cluster

SYMPTOM
The .type file of the Secondary ImpactServer configuration is truncated with the error message:

 *
 *

CAUSE
APAR "IZ81446: IMPACT 511 CLUSTER UNABLE TO REPLICATE DATATYPES WITH USERPARMETERS VALUES IN EXCESS OF 16,000 CHARACTERS." [link below]

RESOLVING THE PROBLEM
Additional comments associated with APAR IZ81446 release notes:

"a new property is added to increase the file size limit:

 *

Add the property to $NCHOME/impact/etc/<SERVERNAME>_server.props file
where size limit can be 8192, 16384, 32768, etc.. "

The property would have to be added to all ImpactServers in the Cluster and would require a restart to enable - ensuring that the ImpactServer started as Primary had the correct, uncorrupted .type file to be replicated across the Cluster. Also ensure that there are no trailing white-space characters on the property as these invalidate properties in lower versions of Impact.

The APAR is not an issue in Impact 6 and 7, but one would still have to include this property with an appropriate value to handle a large character length for the USERPARAMETERS parameter.

The character length includes the whole USERPARAMETERS property name as well as the definition.

For example one would add the property:

 *

to the files:

 *
 *
 *

where one wished to allow the replication of a DataType between two ImpactServers called NCI1 and NCI2 in a Cluster where the USERPARMETERS property line were 20,000 characters long.
RELATED INFORMATION
 APAR IZ81446 [http://www-01.ibm.com/support/docview.wss?uid=swg1IZ81446]

Question:
Why are some Datatypes corrupt after Impact cluster failover/failback ?

Running Impact 7.1.0.11. The symptom is whenever Impact does a failover, a couple DataTypes
turn out empty.

I've checked the type files before and after Impact failover and the difference happens in the property

*.SQL.USERPARAMETERS

This property no longer exists for the corrupted datatypes".

Answer:
"a new property is added to increase the file size limit:

 *

Add the property to $NCHOME/impact/etc/<SERVERNAME>_server.props file
where size limit can be 8192, 16384, 32768, etc.. "

The property would have to be added to all ImpactServers in the Cluster and would require a restart to enable - ensuring that the ImpactServer started as Primary had the correct, uncorrupted .type file to be replicated across the Cluster. Also ensure that there are no trailing white-space characters on the property as these invalidate properties in lower versions of Impact.

The APAR is not an issue in Impact 6 and 7, but one would still have to include this property with an appropriate value to handle a large character length for the USERPARAMETERS parameter.

The character length includes the whole USERPARAMETERS property name as well as the definition.


IBM Automated data collection capability provided by wpcollector tool - United States wpcollector isalite isa lite data collection collector diagnostics TECHNOTE (FAQ)

QUESTION
 What are the benefits of the wpcollector tool? How do I use this tool?

ANSWER
Wpcollector is a command line tool that automates the collection of portal logs and configuration files. Using automated log collection early in the Case life cycle can greatly reduce the number of doc requests that are made by Support.

Wpcollector is delivered with WebSphere Portal beginning with the 7.0 release. If tracing is required for the problem scenario, you must manually enable traceStrings and recreate the problem PRIOR to running wpcollector.

To run wpcollector, please follow the steps, below:

 * If IBM Support has requested tracing, enable it as instructed by the L2 Support Engineer and then recreate the problem. If no tracing is requested, proceed to the step, below:

 * If using Microsoft Windows, Unix/Linux, or IBM i, run the following script from the <wp_profile_root> [http://www-01.ibm.com/support/knowledgecenter/SSHRKX_8.5.0/mp/reference/wpsdirstr.dita]/PortalServer/bin/ directory to begin the collection:  *
    *
    *  Unix/Linux: wpcollector.sh
    *  i: wpcollector.sh
    *
    * Tip: To specify the option for collecting files for the Deployment Manager profile, use the "dmgr.root" parameter. For example:
    *  wpcollector.bat -Ddmgr.root=/opt/IBM/WebSphere/profiles/dmgr_profile

 * If using IBM z/OS, proceed as follows [../reference/wpsdirstr.html%5C]:  *
    *
    *  In the Portal configuration panel, select Collect Diagnostics.
    *  Follow the Customization Dialog instructions for submitting the Collect Diagnostics job (EJPSLOGS).
    *
    * Tip: To collect data from the Deployment Manager, the only requirement is to submit the job from the system where the Deployment Manager is installed (i.e. so it can access the files). There is no prompt in the ISPF panel for this.

 * Locate the wp.mustgather-<timestamp>.zip file in the <wp_profile_root> [http://www-01.ibm.com/support/knowledgecenter/SSHRKX_8.5.0/mp/reference/wpsdirstr.dita]/filesForAutoPD/ directory and follow the instructions in "Exchanging information with IBM Technical Support for problem determination" [http://www-01.ibm.com/support/docview.wss?uid=swg21153852] to manually FTP the collection to IBM. If using z/OS, there may be additional z/OS-specific files required, such as WebSphere Portal servant region or controller region joblogs. Wpcollector currently does not collect these files. Your L2 Support Engineer will inform you in the event these files are needed and provide instructions for collecting them.

 * If tracing was requested and enabled, please follow the instructions provided by the L2 Support Engineer to disable tracing from the environment

RELATED INFORMATION
 Data Collection and Symptom Analysis [http://www-01.ibm.com/support/knowledgecenter/SSHRKX_8.5.0/mp/trouble/tbl_apdt_over.dita?lang=en]

Question: What exactly is "wpcollector" in WebSphere Portal Server? I've been told to get wpcollector output? What exactly is this?

Answer: Wpcollector is a command line tool that automates the collection of portal logs and configuration files.


IBM Security Bulletin: Malicious File Download vulnerability in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE) - CVE-2016-9693 - United States  SECURITY BULLETIN

SUMMARY
 A comma separated file (CSV) download feature exists in IBM BPM and WLE and is available for anonymous users. An attacker can craft a URL that can trigger a download of attacker-supplied content under an attacker-supplied file name onto the victim's machine.

VULNERABILITY DETAILS
CVEID:CVE-2016-9693 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9693]
DESCRIPTION:IBM Business Process Manager has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unauthenticated victim to download a malicious payload. An existing file type restriction can be bypassed so that the payload might be considered executable and cause damage on the victim's machine.
CVSS Base Score: 7.1
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/119517 [https://exchange.xforce.ibmcloud.com/vulnerabilities/119517]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)

AFFECTED PRODUCTS AND VERSIONS
- WebSphere Lombardi Edition V7.2.0.0 - V7.2.0.5
- IBM Business Process Manager Advanced V7.5.0.0 - V7.5.1.2
- IBM Business Process Manager Advanced V8.0.0.0 - V8.0.1.3
- IBM Business Process Manager Advanced V8.5.0.0 - V8.5.7.0 including cumulative fix 2016.12

REMEDIATION/FIXES
Install IBM BPM or WLE interim fix JR57149 [http://www-01.ibm.com/support/docview.wss?uid=swg1JR57149]as appropriate for your current version.

 * IBM Business Process Manager Advanced [http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/IBM+Business+Process+Manager+Advanced&release=All&platform=All&function=aparId&apars=JR57149]
 * IBM Business Process Manager Standard [http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/IBM+Business+Process+Manager+Standard&release=All&platform=All&function=aparId&apars=JR57149]
 * IBM Business Process Manager Express [http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/IBM+Business+Process+Manager+Express&release=All&platform=All&function=aparId&apars=JR57149]
 * WebSphere Lombardi Edition [http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Lombardi+Edition&release=All&platform=All&function=aparId&apars=JR57149]

As IBM Business Process Manager V7.5 and WebSphere Lombardi Edition are out of general support, customers with a support extension contract can contact IBM support to request the fix. The fix disables the vulnerable URL and uses HTML5 features to trigger CSV download without server interaction.

For WebSphere Lombardi Edition 7.2.0.0 through 7.2.0.5

 * Install Fix Pack 5 [http://www-01.ibm.com/support/docview.wss?uid=swg24034270] as required by iFix and then apply iFix JR57149 [https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&function=aparId&apars=JR57149]

For IBM BPM V7.5.0.0 through V7.5.1.2:  * Upgrade to minimal Refresh Pack 1 [http://www-01.ibm.com/support/docview.wss?uid=swg24031230], install Fix Pack 2 [http://www-01.ibm.com/support/docview.wss?uid=swg24036462] as required by iFix and then apply iFix JR57149 [https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&function=aparId&apars=JR57149]

For IBM BPM V8.0.0.0 through V8.0.1.3  * Upgrade to minimal Refresh Pack 1 [http://www-01.ibm.com/support/docview.wss?uid=swg24033777], install Fix Pack 3 [http://www-01.ibm.com/support/docview.wss?uid=swg24037734] as required by iFix and then apply iFix JR57149 [https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&function=aparId&apars=JR57149]

For IBM BPM V8.5.0.0 through V8.5.0.2  * Install Fix Pack 2 [http://www-01.ibm.com/support/docview.wss?uid=swg24040683] as required by iFix and then apply iFix JR57149 [https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&function=aparId&apars=JR57149]

For IBM BPM V8.5.5.0  * Apply iFix JR57149 [https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&function=aparId&apars=JR57149]

For IBM BPM V8.5.6.0 through V8.5.6.0 CF2  * Install CF2 [http://www-01.ibm.com/support/docview.wss?uid=swg24041303] as required by iFix and then apply iFix JR57149 [https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&function=aparId&apars=JR57149]

For IBM BPM V8.5.7.0 through V8.5.7.0 CF 2016.12  * Install CF 2016.12 [https://www.ibm.com/support/docview.wss?uid=swg27048992] and then apply iFix JR57149 [https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&function=aparId&apars=JR57149]

WORKAROUNDS AND MITIGATIONS
None

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

IMPORTANT NOTE
 IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site [http://www.ibm.com/systems/z/solutions/security_subintegrity.html]. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.

REFERENCES
Complete CVSS v3 Guide [http://www.first.org/cvss/user-guide]
On-line Calculator v3 [http://www.first.org/cvss/calculator/3.0]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

ACKNOWLEDGEMENT
The vulnerability was reported to IBM by Nalla Muthu S and Prasath K

CHANGE HISTORY
 24 Feb 2017: initial version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Cross reference information Segment Product Component Platform Version Edition Business Integration IBM Business Process Manager Express Security Linux, Windows 8.5.7.CF201612, 8.5.7.CF201609, 8.5.7.CF201606, 8.5.7, 8.5.6.2, 8.5.6.1, 8.5.6, 8.5.5, 8.5.0.2, 8.5.0.1, 8.5, 8.0.1.3, 8.0.1.2, 8.0.1.1, 8.0.1, 8.0, 7.5.1.2, 7.5.1.1, 7.5.1, 7.5.0.1, 7.5 Business Integration IBM Business Process Manager Standard Security AIX, Linux, Solaris, Windows 8.5.7.CF201612, 8.5.7.CF201609, 8.5.7.CF201606, 8.5.7, 8.5.6.2, 8.5.6.1, 8.5.6, 8.5.5, 8.5.0.2, 8.5.0.1, 8.5, 8.0.1.3, 8.0.1.2, 8.0.1.1, 8.0.1, 8.0, 7.5.1.2, 7.5.1.1, 7.5.1, 7.5.0.1, 7.5 Business Integration WebSphere Lombardi Edition Security AIX, HP-UX, Linux, Solaris, Windows 7.2.0.5, 7.2.0.4, 7.2.0.3, 7.2.0.2, 7.2.0.1, 7.2

Question: Help with Security Bulletin: Malicious File Download vulnerability in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE) - CVE-2016-9693 Where can I find information for Security bulletin: Malicious File Download vulnerability in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE) - CVE-2016-9693?

Answer:
CVEID: CVE-2016-9693
DESCRIPTION: IBM Business Process Manager has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unauthenticated victim to download a malicious payload. An existing file type restriction can be bypassed so that the payload might be considered executable and cause damage on the victim's machine.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/119517 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)