IBM(R) Security Access Manager Web Gateway Appliance, 
Patch 7.0.0-ISS-WGA-FP0010 README
===============================================================================

(C) Copyright International Business Machines Corporation 2014. All rights
reserved. U.S. Government Users Restricted Rights -- Use, duplication or
disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

NOTE:  Before using this information and the product it supports,
       read the general information under "NOTICES" in this document.

DATE:  12th December, 2014
-------------------------------------------------------------------------------

    CONTENTS

    1.0 ABOUT THIS PATCH
       1.1 Patch contents
       1.2 Patches superseded


    2.0 APARS AND DEFECTS FIXED


       2.1 Problems fixed by Patch 7.0.0-ISS-WGA-FP0010
       2.2 Problems fixed by Patch 7.0.0-ISS-WGA-FP0008
       2.3 Problems fixed by Patch 7.0.0-ISS-WGA-FP0005
       2.4 Problems fixed by Patch 7.0.0-ISS-WGA-FP0003
       2.5 Problems fixed by Patch 7.0.0-ISS-WGA-FP0002
       2.6 Problems fixed by Patch 7.0.0-ISS-WGA-FP0001


    3.0 BEFORE YOU INSTALL THIS PATCH
       3.1 Create a snapshot of the existing appliance configuration


    4.0 INSTALLING THIS PATCH
       4.1 Installing this patch using the online update server
       4.2 Installing this patch from a local copy of the update


    5.0 UNINSTALLING THIS PATCH


    6.0 AFTER YOU INSTALL THIS PATCH
       6.1 Verify the patch level

    7.0 DOCUMENTATION UPDATES
       7.1 Manual configuration steps will be required to re-enable  SSL-V3 
      for existings configurations after installing this patch.

    8.0 SOFTWARE LIMITATIONS

    9.0 KNOWN PROBLEMS AND WORKAROUNDS

   10.0 NOTICES
       10.1 Trademarks


*****************************************************************************
*****************************************************************************

1.0 ABOUT THIS PATCH
--------------------
 This patch package contains fixes for problems in the IBM Security Access 
 Manager Web Gateway Appliance firmware. This patch requires that Security 
 Access Manager Web Gateway Appliance Version 7.0 is already installed and 
 configured successfully.

1.1 Patch contents

 This patch package contains:

    - This README file.
    - Updated firmware file for the Security Access Manager Web Gateway 
      Appliance.


1.2 Patches superseded

 Patches superseded by this patch:

      7.0.0-ISS-WGA-FP0001
      7.0.0-ISS-WGA-FP0002
      7.0.0-ISS-WGA-FP0003
      7.0.0-ISS-WGA-FP0005
      7.0.0-ISS-WGA-FP0008


2.0 APARS AND DEFECTS FIXED
---------------------------
 Because patches are cumulative, this patch corrects all the problems
 outlined in the following sections.

 For additional APARs that may affect the IBM Security Web Gateway Appliance, 
 please refer to:

     7.0.0-ISS-AWS-FP0010.README



2.1 Problems fixed by Patch 7.0.0-ISS-WGA-FP0010

  APAR: IV67357
  Symptom: "Poodle" vulnerability (CVE-2014-3566) fixes

  APAR: IV67577
  Symptom: upgrade of OPENSSL on appliance to pick up cumulative fixes

  APAR: IV67581
  Symptom: stability issue to strengthen ISAM for Web appliance

  APAR: IV66338
  Symptom: Fix memory graphs to display information correctly

  APAR: IV63711
  Symptom: NTP setting fail with system error

  APAR: IV64910
  Symptom: Stability fixes for fixpacks page in LMI

  APAR: IV64333
  Symptom: Reverse proxy instance name with more than 20 chars cannot be started

  APAR: IV63362
  Symptom: Minor correction in Junction Cookie Javascript Block dialog

  APAR: IV65305
  Symptom: Junction name starting with 'ID' backend server does not appear in LMI

  APAR: IV65308
  Symptom: LMI does not validate reverse proxy instance name

  APAR: IV64919
  Symptom: stability fixes for lmi issues

  APAR: IV64911
  Symptom: JAVA SDK update required



2.2 Problems fixed by Patch 7.0.0-ISS-WGA-FP0008

  APAR: IV56677
  Symptom: Webseal log files not accessible from LMI or webservice

  APAR: IV60645
  Symptom: Dashboard sometimes showing incorrect data for "Average
           Response time" and "Reverse Proxy Throughput" panels

  APAR: IV61161
  Symptom: default junction creation options differ between pdadmin and LMI

  APAR: IV59660
  Symptom: high cpu utilization by webseal process

  APAR: IV60055
  Symptom: certificate refresh with GSKIT 8.0.50.18 fails

  APAR IV61557
  Symptom: IBM Security Access Manager for Mobile appliance - LMI Authentication
           Bypass (CVE-2014-3053)
           An undisclosed vulnerability can allow unauthorized users to login to
           the Local Management Interface of the IBM Security Access Manager for
           Web/Mobile appliance with invalid credentials.

  APAR IV61563
  Symptom: IBM Security Access Manager for Web/Mobile appliance - Remote Code
           Execution (CVE-2014-3073)
           An undisclosed vulnerability can allow unauthorized users to run
           unauthorized code on the IBM Security Access Manager for Mobile
           appliance.

  APAR IV61558
  Symptom: IBM Security Access Manager for Web - Potential Denial of Service
           (CVE-2010-5107)
           IBM Security Access Manager for Web could be affected by a Denial of
           Service (DOS) attack due to a vulnerability in the OpenSSH toolkit.

  APAR IV61561
  Symptom: IBM Security Access Manager for Web/Mobile is affected by the following
           OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0198, CVE-2010-5298,
           CVE-2014-3470 and possibly CVE-2014-0076
           Security vulnerabilities have been discovered in OpenSSL that were
           reported on June 5, 2014 by the OpenSSL Project.


2.3 Problems fixed by Patch 7.0.0-ISS-WGA-FP0005

  APAR IV56677
  Symptom: Permission denied when viewing proxy logs via the LMI

  APAR IV56037
  Symptom: Unable to configure new WebSEAL instance on the Web 
           Gateway Appliance

  APAR IV55786
  Symptom: SSL Certificates not listed while in edit mode after
           FP 3 applied

  APAR IV53549
  Symptom: Exporting zip from LMI/cURL not working

  APAR IV53209
  Symptom: Configuration of 'process-root-requests' not supported on
           ISAM 7 WGA Appliance

  APAR IV54703
  Symptom: System events not recoreded to remote syslog server

  APAR IV51345
  Symptom: WGA: webseald can not be restarted by "server restart " /
           "cluster restart"

  APAR IV58922
  Symptom: Kerberos Keyfiles deleted and then recreated again in one session
           are deleted

2.4 Problems fixed by Patch 7.0.0-ISS-WGA-FP0003

  APAR IV47932
  Symptom: Can not edit junction options if Lang is Japanese using LMT

  APAR IV50421
  Symptom: Error WGAWA0003I while attempting to edit configuration file
           in WGA

  APAR IV51041
  Symptom: Problems listing reverse proxies in LMI with certain recent
             browser updates

  APAR IV51341
  Symptom: Error WGAWA0003I occurs while importing configuration

  APAR IV51575
  Symptom: On an appliance, the default route can only be applied to the
           management interface

2.5 Problems fixed by Patch 7.0.0-ISS-WGA-FP0002

  APAR IV50147
  Symptom: Fix translation error for Russian locale

  APAR IV50150
  Symptom: When the LMI is used to add or remove an Authentication Level 
           for a specific webseal instance.  The modification adds 
           mutiple entries of LEVEL=UNAUTHENTICATED in the conf file.

   This patch also provides a fix for the problems that are corrected by 
   IBM Security Access Manager for Web Patch 7.0.0-ISS-WGA-FP0002.

2.6 Problems fixed by Patch 7.0.0-ISS-WGA-FP0001

  APAR IV39028:
  Symptom: A couple of the 'help' links that can be accessed from the
           local management interface do not reference valid HTML pages.

  APAR IV39030:
  Symptom: If you attempt to start the packet tracing functionality on the
           appliance you currently get an error.

  APAR IV39032:
  Symptom: If you create a junction using the pdadmin utility and then 
           attempt to view the junction using the local management interface, 
           the 'Junction cookie javascript block' value is not loaded 
           correctly.

  APAR IV39033:
  Symptom: If you attempt to use an unsupported hypervisor to install the 
           virtual appliance, the installation fails to start, but
           the reason for this failure is not obvious.  A change is included 
           in the patch so that an appropriate error message is displayed to 
           the user.

  APAR IV39074:
  Symptom: Audit style events that are detected by the Web Application 
           Firewall functionality cannot have their default actions
           overridden.  The Web Reverse Proxy currently ignores any
           configured actions for these types of events.

  APAR IV39036:
  Symptom: There are some missing translated strings for some of the Asian 
           languages, which means that error messages are displayed in 
           certain panels of the local management interface.

  APAR IV39083:
  Symptom: The management and application interfaces can currently be
           incorrectly configured so that they share the same IP address.

  APAR IV39084:
  Symptom: Static routes cannot currently be set for the application
           interfaces.

  APAR IV39029:
  Symptom: Due to the way in which the local management interface has been
           implemented, only a single administrator can manage the
           appliance at a single time.  However, there is currently no 
           protection from multiple administrators logging into the appliance 
           at the same time.  A change is included in this patch so
           that only a single administrator can be logged into the local
           management interface at a time.

  APAR IV39035:
  Symptom: The appliance is unable to act as a front-end load balancer to
           Web Reverse Proxy instances that reside in  the same appliance.
           This limitation is now fixed and the updated documentation 
           provides clear direction on how to configure a Highly Available 
           environment with as few as two appliances.

  APAR IV39080:
  Symptom: The local management interface does not currently provide
           a mechanism to configure the Kerberos environment for the
           appliance.  Due to this limitation, the Web Reverse Proxy is not 
           able to support 'Windows Desktop SSO' style authentication.  The 
           local management interface is now extended so that you can 
           configure the Kerberos environment.

3.0 BEFORE YOU INSTALL THIS PATCH
--------------------------------
 Before you install this patch, review the following prerequisites and
 dependencies.


3.1 Create a snapshot of the existing appliance configuration

 Before you apply the firmware update to the appliance, it is best to take a 
 snapshot of the current configuration. Perform  the following steps in the 
 local management interface to create a snapshot:

   1. Log on to the local management interface.
   2. Select Manage System Settings -> Snapshots from the menu.
   3. Select New to create the snapshot and give the snapshot an 
      appropriate name.
   4. Select the newly created snapshot, click Download, and save 
      the snapshot on a local drive.


4.0 INSTALLING THIS PATCH
-------------------------
 NOTE: Before you install this patch, be sure that you have completed the 
       backup procedure in section 3.0, "BEFORE YOU INSTALL THIS PATCH".

4.1 Installing this patch using the online update server

  Please note that the method of using the online update server to install
  the patch is not currently available.  It will be made available in the
  near future.  For the time being the package file should be downloaded
  from FixCentral and then applied to the appliance using the method which
  is described in section 4.2 of this document (Installing this patch from 
  a local copy of the update).

  To use the online update server, ensure that the following two
  pre-conditions are met:

    1. A valid license is installed on the appliance;

    2. The appliance has network connectivity to the online update
       server (xpu.iss.net)

  Using the local management interface:

    1. Go to the updates screen by selecting
           Management System Settings -> Available Updates.

    2. Refresh the list of available updates by clicking Refresh
       .  The table is updated to show the available updates.  It
       is important to note that only newer versions of the firmware are 
       displayed in this table.

    3. Download and apply the update by selecting the firmware update in  
       the table and then clicking Install.  The firmware update 
       can take a long time to complete, depending on the 
       bandwidth that is available to the appliance.  After  the update
       is successfully applied to the system, the appliance reboots 
       automatically.

4.2 Installing this patch from a local copy of the update

  Using the local management interface:

    1. Go to the updates screen by selecting 
           Manage System Settings -> Available Updates.

    2. Upload the firmware update file by selecting Upload and then 
       supplying the firmware package file name. The upload process might 
       take several minutes, and the table that shows the updates can take
       a little while to update after the upload is complete. 

    3. Apply the update by selecting the firmware update in the table and 
       then clicking Install.  The firmware takes a few minutes to complete 
       the update and then the appliance automatically reboots.

  Using a USB drive (hardware appliance only):

    1. Copy the firmware update onto a USB flash drive.  The flash drive should
       be formatted with a FAT file system.

    2. Insert the USB flash drive into the hardware appliance.

    3. Log onto the appliance console, or ssh into the appliance, as the 'admin'
       user.

    4. Go to the 'updates' menu by typing 'updates', and then press Enter.

    5. Install the update by typing 'install', and then press Enter.  The
       following options should then be selected:
         '1'     : For a firmware update;
	 '1'     : To install the update from a USB drive;
	 'YES'   : To confirm that the USB drive is plugged into the appliance;
	 <index> : Select the appliance firmware from the list;
	 'YES'   : to confirm the update and start the update process;

    Note: The firmware update takes a few minutes to complete and then 
          the appliance automatically reboots.

5.0 UNINSTALLING THIS PATCH
---------------------------

 It is not possible to uninstall the firmware update, but it is possible to 
 boot the appliance to the prior version of the firmware.

 Using the local management interface:

    1. Go to the firmware settings screen by selecting
           Manage System Settings -> Firmware Settings.

    2. Click the 'Set Active' link in the 'Action' column of the table.

    3. Click Yes to accept the warning about swapping the partition.
.  This automatically reboots the machine with the previous
       firmware partition.

6.0 AFTER YOU INSTALL THIS PATCH
------------------------------
 Complete the following tasks after the patch is installed.


6.1 Verify the patch level

 Using the local management interface:

    1. Go to the firmware settings screen by selecting
           Manage System Settings -> Firmware Settings.

    2. Examine the details that are associated with the 'Active' partition 
       and ensure that the firmware version is correct.

7.0 DOCUMENTATION UPDATES
-------------------------

 The product documentation for IBM Security Access Manager Web Gateway
 Appliance, Version 7.0, is in the product Information Center at the following 
 web address (entered as one line):

 http://pic.dhe.ibm.com/infocenter/tivihelp/v2r1/topic/com.ibm.isam.doc_70/appliance.html


7.1 Manual configuration steps will be required to re-enable  SSL-V3 
    for existings configurations after installing this patch.

  Note: To edit Reverse Proxy (Webseal) configuration files on the Security Access Manager Web Gateway Appliance
  using the LMI:  Under "Secure Reverse Proxy Settings", select "Manage -> Reverse Proxy", then select the
  reverse proxy instance to manage, then select "Manage -> Configuration -> Edit Configuration file"


  To address "Poodle" vulnerability (CVE-2014-3566), SSLv3 is now disabled  and TLS 1.0 is enabled
  by default.  For any existing configurations in which SSLv3 is still required manual changes to the 
  configuration files will be  necessary.  This may be the case in environments with  servers that don't 
  yet have the patch applied.  To accommodate this requirement, two new options have been added  
  to allow control over the protocols:    ssl-v3-enable     and   tls-v10-enable


  For example, to enable SSLv3 and disable TLS
   [ssl]
   ssl-v3-enable = yes
   tls-v10-enable = no

   Note 1.   These options only affect communications back to the policy server or authorization server.


    The WebSEAL options for disabling SSL v3 to clients are still the same.  The recommended settings are:
    [ssl]
    # Selectively disable SSL version support for browser connections
    disable-ssl-v2 = yes
    disable-ssl-v3 = yes
    disable-tls-v1 = no

    [junction]
    # Selectively disable SSL version support for junction connections
    disable-ssl-v2 = yes
    disable-ssl-v3 = yes
    disable-tls-v1 = no



8.0 SOFTWARE LIMITATIONS
------------------------

 None.



9.0 KNOWN PROBLEMS AND WORKAROUNDS
------------------------------------------------

 None.


10.0 NOTICES 
--------------------

This information was developed for products and services offered in the U.S.A.
IBM may not offer the products, services, or features discussed in this 
document in other countries. Consult your local IBM representative for 
information on the products and services currently available in your area. Any 
reference to an IBM product, program, or service is not intended to state or 
imply that only that IBM product, program, or service may be used. Any 
functionally equivalent product, program, or service that does not infringe 
any IBM intellectual property right may be used instead. However, it is the 
user's responsibility to evaluate and verify the operation of any non-IBM 
product, program, or service.

IBM may have patents or pending patent applications covering subject matter
described in this document. The furnishing of this document does not give you
any license to these patents. You can send license inquiries, in writing, to:

IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785 U.S.A.

For license inquiries regarding double-byte character set (DBCS) information,
contact the IBM Intellectual Property Department in your country or send
inquiries, in writing, to:

Intellectual Property Licensing
Legal and Intellectual Property Law
IBM Japan, Ltd.
19-21, Nihonbashi-Hakozakicho, Chuo-ku
Tokyo 103-8510, Japan

The following paragraph does not apply to the United Kingdom or any other
country where such provisions are inconsistent with local law :
INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS
PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER
EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS
FOR A PARTICULAR PURPOSE.

Some states do not allow disclaimer of express or implied warranties in certain
transactions, therefore, this statement might not apply to you.
This information could include technical inaccuracies or typographical errors.
Changes are periodically made to the information herein; these changes will be
incorporated in new editions of the publication. IBM may make improvements
and/or changes in the product(s) and/or the program(s) described in this
publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for
convenience only and do not in any manner serve as an endorsement of those Web
sites. The materials at those Web sites are not part of the materials for this 
IBM product and use of those Web sites is at your own risk.
IBM may use or distribute any of the information you supply in any way it
believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purpose
of enabling: (i) the exchange of information between independently created
programs and other programs (including this one) and (ii) the mutual use of the
information which has been exchanged, should contact:

IBM Corporation
2Z4A/101
11400 Burnet Road
Austin, TX 78758 U.S.A.

Such information may be available, subject to appropriate terms and conditions,
including in some cases payment of a fee.

The licensed program described in this document and all licensed material
available for it are provided by IBM under terms of the IBM Customer Agreement,
IBM International Program License Agreement or any equivalent agreement
between us.

Any performance data contained herein was determined in a controlled
environment. Therefore, the results obtained in other operating environments may
vary significantly. Some measurements may have been made on development-level
systems and there is no guarantee that these measurements will be the same on
generally available systems. Furthermore, some measurement may have been
estimated through extrapolation. Actual results may vary. Users of this document
should verify the applicable data for their specific environment.

Information concerning non-IBM products was obtained from the suppliers of
those products, their published announcements or other publicly available 
sources.  IBM has not tested those products and cannot confirm the accuracy of
performance, compatibility or any other claims related to non-IBM products.
Questions on the capabilities of non-IBM products should be addressed to the
suppliers of those products.

All statements regarding IBM's future direction or intent are subject to 
change or withdrawal without notice, and represent goals and objectives only.

All IBM prices shown are IBM's suggested retail prices, are current and are 
subject to change without notice. Dealer prices may vary.

This information is for planning purposes only. The information herein is 
subject to change before the products described become available.

This information contains examples of data and reports used in daily business
operations. To illustrate them as completely as possible, the examples include 
the names of individuals, companies, brands, and products. All of these names 
are fictitious and any similarity to the names and addresses used by an actual 
business enterprise is entirely coincidental.

COPYRIGHT LICENSE:

This information contains sample application programs in source language, which
illustrate programming techniques on various operating platforms. You may copy,
modify, and distribute these sample programs in any form without payment to IBM,
for the purposes of developing, using, marketing or distributing application
programs conforming to the application programming interface for the operating
platform for which the sample programs are written. These examples have not
been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or
imply reliability, serviceability, or function of these programs. You may copy,
modify, and distribute these sample programs in any form without payment to
IBM for the purposes of developing, using, marketing, or distributing 
application programs conforming to IBM's application programming interfaces.

Each copy or any portion of these sample programs or any derivative work, must
include a copyright notice as follows:
(C) (your company name) (year). Portions of this code are derived from IBM Corp.
Sample Programs. (C) Copyright IBM Corp. _enter the year or years_. All rights
reserved.

If you are viewing this information in softcopy form, the photographs and color
illustrations might not be displayed.

10.1 Trademarks
IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of
International Business Machines Corp., registered in many jurisdictions 
worldwide.  Other product and service names might be trademarks of IBM or 
other companies.  A current list of IBM trademarks is available on the Web 
at Copyright and trademark information at www.ibm.com/legal/copytrade.shtml.

Adobe, Acrobat, PostScript and all Adobe-based trademarks are either registered
trademarks or trademarks of Adobe Systems Incorporated in the United States,
other countries, or both.

IT Infrastructure Library is a registered trademark of the Central Computer and
Telecommunications Agency which is now part of the Office of Government
Commerce.

Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel 
Centrino logo, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium 
are trademarks or registered trademarks of Intel Corporation or its 
subsidiaries in the United States and other countries.

Linux is a trademark of Linus Torvalds in the United States, other countries, 
or both.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of
Microsoft Corporation in the United States, other countries, or both.

ITIL is a registered trademark, and a registered community trademark of the 
Office of Government Commerce, and is registered in the U.S. Patent and 
Trademark Office.

UNIX is a registered trademark of The Open Group in the United States and 
other countries.
Java and all Java-based trademarks and logos are trademarks or registered
trademarks of Oracle and/or its affiliates.
Cell Broadband Engine is a trademark of Sony Computer Entertainment, Inc. in the
United States, other countries, or both and is used under license therefrom.

Linear Tape-Open, LTO, the LTO Logo, Ultrium, and the Ultrium logo are
trademarks of HP, IBM Corp. and Quantum in the U.S. and other countries.

 
 End of IBM Security Access Manager Web Gateway Appliance, Patch 7.0.0-ISS-WGA-FP0010 README

