IBM Information for VU#197318

IBM Net.Data db2www CGI interpreter fails to properly validate requested macro filenames



Vendor Statement

IBM acknowledges that this vulnerability exists in the Net.Data product and has already responded to Secunia with the workaround listed below.

For more information see the Secunia advisory.


To block a Net.Data application from being exploited by the vulnerability, the administrator of the Net.Data application has to utilize the DTW_DEFAULT_ERROR_MESSAGE feature, available on all platforms.

Example: In the Net.Data configuration file 'db2www.ini', insert an entry such as

DTW_DEFAULT_ERROR_MESSAGE <PRE>This Web Site is experiencing problems. Check back later. </PRE>

With such an entry, Net.Data will not return the "DTWP001E" error message, thus blocking any security exposure.

Furthermore, Net.Data on zOS and iServer provide a very similar feature, DTW_DEFAULT_MACRO (see Net.Data documentation). Please note that the DTW_DEFAULT_ERROR_MESSAGE feature and the DTW_DEFAULT_MACRO feature are generally recommended to have a web site react in a predictable manner on any kind of problem.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Vendor References



The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.