JR62380: IIDR SYBASE DMSUPPORTINFO COMMAND MAY COLLECT THE DB USERNAME AND PASSWORD IN PLAINTEXT.

APAR status

• Closed as program error.

Error description

• Dmsupportinfo command  for IIDR Sybase ASE engine included DB
  User and password in trace output extracted  when running ddlgen
  to collect db table ddl as part of collection details.
  
  Fix will prevent tracing these details needed for executing the
  command and avoid exposing the db User /password in other files.
  

Local fix

• No Local fix to prevent issue.
  
  Remove un-needed dmsupportinfo collections to avoid exposure of
  sensitive  user/login details.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * This issue might affect you if you are using CDC for Sybase  *
  * 11.3.3.3-109 or earlier.                                     *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * The dmsupportinfo utility used for collecting                *
  * troubleshooting information was collecting the configured    *
  * database username and password.                              *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• Upgrading to IDR 11.3.3.3-113 or newer for Sybase resolves the
  issue.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IS CDC SYBASE

• Fixed component ID

  5725E30SY

Applicable component levels