|
|
|
View Notes By
|
|
|
|
Other Documents
|
|
|
|
|
IBM Information for VU#197318
| Date Notified: | 2004-03-08 |
| Date Updated: | |
| Statement Date: | |
| Status Summary: | Vulnerable |
Vendor StatementIBM acknowledges that this vulnerability exists in the Net.Data product and has already responded to Secunia with the workaround listed below.
For more information see the Secunia advisory.
Workaround:
To block a Net.Data application from being exploited by the vulnerability, the administrator of the Net.Data application has to utilize the DTW_DEFAULT_ERROR_MESSAGE feature, available on all platforms.
Example: In the Net.Data configuration file 'db2www.ini', insert an entry such as
DTW_DEFAULT_ERROR_MESSAGE <PRE>This Web Site is experiencing problems. Check back later. </PRE>
With such an entry, Net.Data will not return the "DTWP001E" error message, thus blocking any security exposure.
Furthermore, Net.Data on zOS and iServer provide a very similar feature, DTW_DEFAULT_MACRO (see Net.Data documentation). Please note that the DTW_DEFAULT_ERROR_MESSAGE feature and the DTW_DEFAULT_MACRO feature are generally recommended to have a web site react in a predictable manner on any kind of problem.Vendor InformationThe vendor has not provided us with any further information regarding this vulnerability.
AddendumThe CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|
 |
