Notified:  March 08, 2004 Updated: March 15, 2004

Status

Affected

Vendor Statement

IBM acknowledges that this vulnerability exists in the Net.Data product and has already responded to Secunia with the workaround listed below. For more information see the Secunia advisory. Workaround: To block a Net.Data application from being exploited by the vulnerability, the administrator of the Net.Data application has to utilize the DTW_DEFAULT_ERROR_MESSAGE feature, available on all platforms. Example: In the Net.Data configuration file 'db2www.ini', insert an entry such as DTW_DEFAULT_ERROR_MESSAGE

This Web Site is experiencing problems. Check back later. 

With such an entry, Net.Data will not return the "DTWP001E" error message, thus blocking any security exposure. Furthermore, Net.Data on zOS and iServer provide a very similar feature, DTW_DEFAULT_MACRO (see Net.Data documentation). Please note that the DTW_DEFAULT_ERROR_MESSAGE feature and the DTW_DEFAULT_MACRO feature are generally recommended to have a web site react in a predictable manner on any kind of problem.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.