WebSphere MQ MQCONN Class resources are not protected in accordance with security.

From z/OS ACF2 STIG

Part of ZWMQ0052

Associated with IA controls: DCCS-1, DCCS-2, ECAR-2, IAIA-2, ECAR-1, IAIA-1

SV-7263r1_rule WebSphere MQ MQCONN Class resources are not protected in accordance with security.

Vulnerability discussion

WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.

Check content

a) Refer to the following report produced by the ACF2 Data Collection: - SENSITVE.RPT(MQCONN) - ACF2CMDS.RPT(RESOURCE) – Alternate report b) Review the following connection resources defined to TYPE(MQK) (i.e., MQCONN resource class): Resource Authorized Users ssid.BATCH TSO and batch job userids ssid.CICS CICS region userids ssid.IMS IMS region userids ssid.CHIN Channel initiator userids NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). c) For all connection resources defined to TYPE(MQK), ensure the following items are in effect: 1) Access authorization to these connections restricts access to the appropriate users as indicated in (b). 2) All access is logged. d) If both of the items in (c) are true, there is NO FINDING. e) If either item in (c) is untrue, this is a FINDING.

Fix text

The IAO will ensure that all connections to MQSeries/WebSphere MQ resources are restricted using connection security. Ensure the following connection resources defined to TYPE(MQK) (i.e., MQCONN resource class): Resource Authorized Users ssid.BATCH TSO and batch job userids ssid.CICS CICS region userids ssid.IMS IMS region userids ssid.CHIN Channel initiator userids NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). For all connection resources defined to TYPE(MQK), ensure the following items are in effect: Access authorization to these connections restricts access to the appropriate users as indicated above. All access is logged. Example: $KEY(ssid) TYPE(MQK) BATCH UID(STCssid) SERVICE(READ) LOG BATCH UID(syspaudt) SERVICE(READ) LOG BATCH UID(*) PREVENT CHIN UID(STCssidCHIN) SERVICE(READ) LOG CHIN UID(*) PREVENT CICS UID(*) PREVENT IMS UID(*) PREVENT

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer