RS03657: HOST HEADER INJECTION/REDIRECTION SECURITY VULNERABILITY

Operational Decision Manager V8.8.1.4: Interim Fix 9
Operational Decision Manager V8.9.2.3: Interim Fix 7 for Decision Center
Operational Decision Manager V8.9.2.3: Interim Fix 8 for Decision Center
Operational Decision Manager V8.9.2.3: Interim Fix 9 for Decision Center
Operational Decision Manager V8.9.2.3: Interim Fix 5
Operational Decision Manager V8.8.1.4: Interim Fix 10
Operational Decision Manager V8.8.1.4: Interim Fix 07

APAR status

• Closed as program error.

Error description

• The Decision Center Enterprise Console appears to trust the
  user-supplied host header. By supplying a malicious host header
  with a password reset request, it may be possible to generate a
  poisoned password reset link.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * Decision Center users.                                       *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * The possibily for a remote attacker to inject custom HTTP    *
  * Host headers not properly handled.                           *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• The code was fixed.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WS DECISION CTR

• Fixed component ID

  5725B6900

Applicable component levels

• R892 PSY

     UP