WebSphere MQ MQCONN Class resources are protected improperly.

From z/OS TSS STIG

Part of ZWMQ0052

Associated with: CCI-000213 CCI-002234

SV-7542r2_rule WebSphere MQ MQCONN Class resources are protected improperly.

Vulnerability discussion

WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.

Check content

a) Refer to the following report produced by the TSS Data Collection: - SENSITVE.RPT(WHOHMCON) b) Review the following connection resources defined to the MQCONN resource class: Resource Authorized Users ssid.BATCH TSO and batch job ACIDs ssid.CICS CICS region ACIDs ssid.IMS IMS region ACIDs ssid.CHIN Channel initiator ACIDs NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). c) For all connection resources defined to the MQCONN resource class, ensure the following items are in effect: 1) Access authorization restricts access to the appropriate users as indicated in (b) above. 2) All access is logged. d) If all of the items in (c) are true, there is NO FINDING. e) If any item in (c) is untrue, this is a FINDING.

Fix text

Review the following connection resources defined to the MQCONN resource class: Resource Authorized Users ssid.BATCH TSO and batch job ACIDs ssid.CICS CICS region ACIDs ssid.IMS IMS region ACIDs ssid.CHIN Channel initiator ACIDs NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). c) For all connection resources defined to the MQCONN resource class, ensure the following items are in effect: 1) Access authorization restricts access to the appropriate users as indicated in (b) above. 2) All access is logged. The following is a sample of the commands required to allow a batch user (USER1) to connect to a queue manager (QM1): TSS ADD(USER1) FAC(QM1MSTR) TSS PER(USER1) MQCONN(QM1.BATCH) ACC(READ) ACTION(AUDIT)

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer