Drop-In ID: OPDM-11.03.00.07-011
Product: IBM® InfoSphere® Optim™ Web Applications
Release: 11.3.0.7
Problem ID: IP24186
Date: July 31, 2019
Description: This iFix corrects the following vulnerabilities in Optim Manager / Optim Connection Manager:
Application allows simultaneous logins from single user ID.
Application does not notify user of last login time and date.
Session timeout is high or not implemented.
Click jacking fix for WebSphere.
Add customized 404 page.
Internal path disclosure error.
HTTP dangerous options are enabled.
Application is vulnerable to SQL Injection Attack.
After applying this iFix, these vulnerabilities will be corrected.
Prerequisites: IBM® InfoSphere® Optim™ Web Applications 11.3.0.7.20181027_1625
Co-requisites:
IBM®
InfoSphere® Optim™ Designer
11.3.0.7.20181027_1629
OPDM-11.03.00.07-007
Supersedes: None
Special Notes: None
OS Platforms: All supported platforms: AIX, RedHat, Solaris, and Windows
Corrective Actions:
If more than one iFix is found by Installation Manager, then all of them will be selected by default. Review each iFix and unselect any that you do not wish to install.
Ensure that all Optim components are not running before applying this iFix.
Continue through the Installation Manager Update wizard to apply this iFix.
Important, This iFix is delivered as a complete Unified Optim war file. After installing this iFix, you must then manually deploy this war file in your Application Web Server.
How to uninstall the fix:
Ensure that all Optim components are not running before uninstalling any iFix.
Start IBM Installation Manager
Select the Uninstall option from the main Installation Manager window or menu.
Select the iFix you wish to uninstall.
Continue through the Installation Manager Uninstall wizard to remove this iFix.
This iFix will automatically be uninstalled if you upgrade to a new version.
Important, When you use Installation Manager to uninstall this iFix, it does not remove it from your Application Web Server. You must manually remove this war file from your Application Web Server.
If you have any questions about or problems with these procedures, contact IBM Optim Support.