Secunia

Description

IBM has acknowledged a weakness and some vulnerabilities in IBM WebSphere Application Server for z/OS, which can be exploited by malicious people to manipulate certain data, cause a DoS (Denial of Service), bypass certain security restrictions, conduct cross-site request forgery attacks, or compromise a vulnerable system.

1) A weakness and some vulnerabilities can be exploited by malicious people to manipulate certain data, cause a DoS (Denial of Service), or compromise a vulnerable system.

For more information:
SA37545

2) A vulnerability in Apache "mod_proxy_ftp" module can be exploited by malicious people to bypass certain security restrictions.

For more information:
SA36675

3) The administrative console allows cross-site request forgery attacks

For more information see vulnerability #3 in:
SA37221

Solution
Apply APARs PM02614 and PM04110.
Further details available in Customer Area

Changelog
Further details available in Customer Area

Original Advisory
IBM (PK91361, PK93225, PK96858, PM00675):
http://www-01.ibm.com/support/docview.wss?uid=swg1PM02614

IBM (PM04110, PK87176):
http://www-01.ibm.com/support/docview.wss?uid=swg1PM04110

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area