README VERSION               : 1.1
README CREATION DATE         : 2016-08-19
PATCH-ID                     : vom-HF0710100 
PATCH NAME                   : Veritas Infoscale Operations Manager 7.1 Hotifx 100
BASE PACKAGE NAME            : VRTSfmh
BASE PACKAGE VERSION         : 7.1.0.0
SUPERSEDED PATCHES           : NONE
REQUIRED PATCHES             : NONE
INCOMPATIBLE PATCHES         : NONE
SUPPORTED PADV               : rhel6_x86_64, rhel7_x86_64, sles11_x86_64, sles12_x86_64, w2k12r2X64, w2k8r2X64
(P-PLATFORM , A-ARCHITECTURE , D-DISTRIBUTION , V-VERSION)
PATCH CATEGORY               :  MH
PATCH CRITICALITY            : RECOMMENDED
HAS KERNEL COMPONENT         : NO
ID                           : vom-HF0710100
REBOOT REQUIRED              : NO
REQUIRE APPLICATION DOWNTIME : YES

PATCH INSTALLATION INSTRUCTIONS:
--------------------------------
IMPORTANT NOTE : Please take a backup of the database using the instructions given in the Admin guide before installing this Hotfix.

This Hotfix has Vulnerability fixes applicable to VIOM 7.1 Management Server so install this hotfix to VIOM 7.1 Management Server only.
In VIOM GUI, it may be observed that hotfix is applicable to VIOM 7.1 Managed Hosts too but please DO NOT install hotfix on Managed Hosts.

1. Download the file vom-7.1.0.100.sfa
2. Launch a browser and login to the VIOM management server.
3. Navigate to Settings ->          Deployment Icon.
4. Upload the Hotfix to the VIOM CMS using the "Upload Solutions" button.
   The Hotfix vom-7.1.0.100 should be visible in the Hot Fixes tree node.
5. Please install this Hotfix on CS using the following instructions:
    - Go to Settings ->         Deployment ->         Hot Fixes ->         Veritas Infoscale Operations Manager Managed Host.
    - Click on Hot Fixes Tab. Click on Applicable Hosts Tab.
    - Right click on CS Name and click on Install.

PATCH UNINSTALLATION INSTRUCTIONS:
----------------------------------
Un-installation and rollback of this Hotfix is not supported.

SPECIAL INSTRUCTIONS:
-----------------------------
It requires approximately around 3 GB of disk space to upload vom-7.1.0.100.sfa. Please ensure that Management Server has at least 3 GB of free disk space where CMS is installed.

SUMMARY OF FIXED ISSUES:
-----------------------------------------
 PATCH ID:vom-HF0710100
3895769 (3895914)  Veritas Infoscale Operations Manager Vulnerabilities. 


SUMMARY OF KNOWN ISSUES:
-----------------------------------------
NONE 



KNOWN ISSUES : 
--------------
NONE

FIXED INCIDENTS: 
----------------

 PATCH ID:vom-HF0710100

 * INCIDENT NO:3895769	 TRACKING ID:3895914

SYMPTOM: 
1. VULNERABILITY: Remote Command Execution via VIOM.
2. VULNERABILITY: Unauthenticated Blind SQL Injection via VIOM. 


DESCRIPTION: 
1. VULNERABILITY: Remote Command Execution via VIOM
- An authenticated, unprivileged user can execute arbitrary commands as root using remote 
command injection.  This can lead to full compromise of the system.

2. VULNERABILITY: Unauthenticated Blind SQL Injection via VIOM
- An unauthenticated user can execute arbitrary commands using SQL injection. On Linux 
this command runs as an unprivileged user.  On Windows this command runs as SYSTEM.

RESOLUTION: VULNERABILITY: Remote Command Execution via VIOM
- VIOM scripts have been fixed to not allow command execution from unauthorized users.

VULNERABILITY: Unauthenticated Blind SQL Injection via VIOM
- VIOM scripts have been fixed to not allow Blind SQL Injection.


INCIDENTS FROM OLD PATCHES:
---------------------------
NONE