Patch-ID# 141709-03

6899619 Upgrade NSS bits to 3.12.5 for SSL3 & TLS Renegotiation Vulnerability.
 
(from 141709-02)
6870754 Changing  jdk version to 1.5.0_20-b20
6868619 Fix XMLDSig vulnerability
 
(from 141709-01)
6820994 JS may be executed by URL from authorized user
6717148 Minor XSS vulnerability in admin-gui for authorized user
6806221 Incorrect behaviour with HTTPServletResponse OutputStream#flushBuffer()

-------------------------------------------------
 
To install this patch, run the command:
 
1. Shutdown all Sun GlassFish Enterprise Server processes of the server instance to be patched using asadmin stop-domain command.
2. patchadd PATCHID
3. To add/remove a patch on Solaris 10, "-G" option needs to be given( refer to bug 6395605).
   patchadd -G <PATCHID> patchrm  -G <PATCHID>
 
To un-install this patch, run the command:
 
1. Shutdown all Sun Java System Application Server processes of the server instance to be unpatched using asadmin stop-domain command.
2. patchrm PATCHID
 
Special installation Instructions: 
-------------------------------------------------
1. Dependent component prerequisite for patching
   i.  The following MQ 4.1U1P1 patches need to be applied if a package
based installation of the application server is being patched. If a file based
installation of GlassFish v2.1 has its MQ configured to be connected to as
REMOTE,then these patches need to be applied to the remote MQ installation.(MQ4.1U1P1 = MQ4.3[Both are supported in GlassFish v2.1])	
	127411-05 sparc
	127412-06 sparc c-api
	127413-05 x86
	127414-05 x86 c-api
	127415-05 linux
	127416-05 windows
   ii.Following JAVADB patches need to be applied for GlassFish v2.1
	125270-04 linux.i386
        125246-03 solaris.i386
        125245-04 solaris.sparc
        125272-03 windows.i386
 
 
Known Issue
------------------------------
1>Appserver may fail to start sometimes
Cause: If Appserver is installed by user X and domain for user Y is created and operated by user Y
and if ONLY appserver or MQ is patched/upgraded.
Reason: Appserver while starting does automatic upgrade of a jar which is required for integration with MQ.
this jar is located at <AS_INSTALL>/lib/install/applications/jmsra
This folder has write permission only for user X, since user X has installed the appserver.
Solution:
1>Provide write permission only for user Y only for this folder, recommended
or
2>Upgrade/patch appserver and MQ to the same level. Highly recommended
MQ and appserver patch releases are aligned.
or
3>Manually copy imqjmsra.rar to <AS_INSTALL>/lib/install/applications/jmsra
then do jar xvf imqjmsra.rar
then delete imqjmsra.rar
This needs to be done every time ONLY MQ or Appserver is patched/upgraded.-Not recommended
ex:user X can be root and user Y can be non-root user.

0