IBM has acknowledged multiple vulnerabilities in IBM WebSphere Application Server for z/OS, where some have an unknown impact and others can be exploited by malicious people to bypass certain security restrictions and manipulate certain data.

1) Some vulnerabilities are caused due to unspecified errors related to the administrative console. No additional information is currently available.

2) A vulnerability in Apache "mod_proxy_ftp" module can be exploited by malicious people to bypass certain security restrictions.

For more information:
SA36675

3) A vulnerability is caused due to an error in the TLS protocol while handling session re-negotiations.

For more information:
SA37291

Solution
Apply APARs PM00675, PK96858, and PK97376 or Fix Pack 7.0.0.9 as soon as it becomes available.

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
IBM (PK96858, PK97376):
http://www-01.ibm.com/support/docview.wss?uid=swg1PM09161

IBM (PM00675):
http://www-01.ibm.com/support/docview.wss?uid=swg1PM09163

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area