CA Top Secret Security for z/os CA RS 1409 Service List

Transcription

1 CA Top Secret Security for z/os CA RS 1409 Service List Description Type 15.0 RO71034 TSSCFILE ABENDS WITH S878-10, OUT OF STORAGE PTF RO71198 CHORUSSTATG NOT STARTING AFTER TSS MODIFY PTF RO71376 ALLOW XMEM FASTAUTH TO USE ACEEALET= WHEN NOT IN XMEM MODE PTF RO71959 S0C4 TSSCRVAL+246E ON A TD QUEUE JOB SUBMIT PTF RO72050 SP-252 KEY-0 DEADMAIN STORAGE SAFCR712 A/RO63740 *HIP/PRP* RO72234 TSSCFILE ERROR ON TSS MODIFY(STATUS) PTF RO72677 TSS MAY LOOP WHEN PROCESSING RECOVERY CMD WITH AES *HIP/PRP* The CA RS 1409 service count for this release is 7

2 CA Top Secret Security for z/os CA RS 1409 Service List Description Type 14.0 NO-SRVC CA RS 1409 Contains No Service For This Release of This Product. PTF The CA RS 1409 service count for this release is 0

3 CA Top Secret Security for z/os 3 CA RS 1409 Service List for CAKOF00 FMID Service Description Type CAKOF00 RO71034 TSSCFILE ABENDS WITH S878-10, OUT OF STORAGE PTF RO71198 CHORUSSTATG NOT STARTING AFTER TSS MODIFY PTF RO71376 ALLOW XMEM FASTAUTH TO USE ACEEALET= WHEN NOT IN XMEM MODE PTF RO72050 SP-252 KEY-0 DEADMAIN STORAGE SAFCR712 A/RO63740 *HIP/PRP* RO72234 TSSCFILE ERROR ON TSS MODIFY(STATUS) PTF RO72677 TSS MAY LOOP WHEN PROCESSING RECOVERY CMD WITH AES *HIP/PRP* The CA RS 1409 service count for this FMID is 6

4 CA Top Secret Security for z/os 4 CA RS 1409 Service List for CAKOF01 FMID Service Description Type CAKOF01 RO71959 S0C4 TSSCRVAL+246E ON A TD QUEUE JOB SUBMIT PTF The CA RS 1409 service count for this FMID is 1

5 CA Top Secret Security for z/os CA RS PTF RO RO71034 RO71034 M.C.S. ENTRIES = ++PTF (RO71034) TSSCFILE ABENDS WITH S878-10, OUT OF STORAGE TSSCFILE ABEND with S out of private storage in subpool 1 key 8. TSSCFILE cannot keep up with the output that is being generated by the command processing in the TSS address space. Over time buffer storage backup in TSSCFILE address space, causing the S The TSSCFILE job ABENDS and with only partial output. One can try to rerun the TSSCFILE job at a higher priority. PRODUCT(S) AFFECTED: CA Top Secret for z/os Release 15.0 CA Top Secret for z/os Release 14.0 TSSMVS 9534 Copyright (C) 2014 CA. All rights reserved. R01002-TSS150-SP1 DESC(TSSCFILE ABENDS WITH S878-10, OUT OF STORAGE FMID (CAKOF00) PRE ( RO20497 RO22442 RO23523 RO25119 RO35644 RO36198 RO38472 RO38876 RO43262 RO50801 RO55678 RO63150 RO63740 RO64503 RO69457 RO70635 ) SUP ( TR26159 RO26159 TR26572 RO26572 TR38113 DR36198 TR40741 RO38113 RO40741 TR45022 TR46328 TR56578 RO46328 TR57834 RO57834 TR60151 RO60151 TR60841 RO60841 TR66026 RO56578 RO66026 TR66067 TR71034 ) ++HOLD (RO71034) SYSTEM FMID(CAKOF00) REASON (DYNACT ) DATE (14216) CA Top Secret for z/os Release 15.0 SEQUENCE After Apply PURPOSE Prevent TSSCFILE from buffer backup in the address space USERS Users that are using TSSCFILE KNOWLEDGE 1- Product Administration 3- z/os Systems Programming REQUIRED 2- SMP/e 4- Security Administration ACCESS SMP/e CSI libraries REQUIRED SMP APPLY, LLA REFRESH and a restart of TSS,,,REINIT is required to install this APAR.

6 CA Top Secret Security for z/os CA RS PTF RO RO71198 RO71198 M.C.S. ENTRIES = ++PTF (RO71198) CHORUSSTATG NOT STARTING AFTER TSS MODIFY When the TSS MODIFY Commands below are issued: 1) CHORUSSTATG(ON) 2) CHORUSSTATI(0030) And TSS control option STATG(ON) is already set, the TSS Chorus Time Series metrics are not activated. No Chorus STATG records are written to Chorus Time Series Facility (TSF No STATG records are in TSF database. Add CHORUSSTATG(ON) to the TSS PARMLIB. PRODUCT(S) AFFECTED: CA Top Secret for z/os Release 15.0 TSSMVS 9584 Copyright (C) 2014 CA. All rights reserved. R01004-TSS150-SP1 DESC(CHORUSSTATG NOT STARTING AFTER TSS MODIFY FMID (CAKOF00) PRE ( RO36198 ) SUP ( ER36198 TR41881 RO41881 TR71198 ) ++HOLD (RO71198) SYSTEM FMID(CAKOF00) REASON (DYNACT ) DATE (14175) CA Top Secret for z/os Release 15.0 SEQUENCE After Apply PURPOSE Correct dynamic start of Chorus STATG feature USERS All Chorus STATG users. KNOWLEDGE 1- SMP/E 2- z/os Systems Programming REQUIRED 3- Security Administration ACCESS SMP/E CSI libraries REQUIRED LLA Refresh and TSS REINIT

7 CA Top Secret Security for z/os CA RS PTF RO RO71376 RO71376 M.C.S. ENTRIES = ++PTF (RO71376) ALLOW XMEM FASTAUTH TO USE ACEEALET= WHEN NOT IN XMEM MODE TSS does not support cross memory FASTAUTH calls if the caller is not actually in cross memory mode. The results of the security call will be based upon the incorrect user. Results are variable. Access may be allowed or disallowed improperly. This problem was noticed running OEM product ZPROTECT. None. PRODUCT(S) AFFECTED: CA Top Secret for z/os Release 15.0 TSSMVS 9576 Copyright (C) 2014 CA. All rights reserved. R01006-TSS150-SP1 DESC(ALLOW XMEM FASTAUTH TO USE ACEEALET= WHEN NOT IN XMEM MODE FMID (CAKOF00) PRE ( RO18784 RO19158 RO25587 RO32654 RO35644 RO36198 RO45458 RO46592 RO47831 RO47860 RO55678 RO58366 RO63740 ) SUP ( AR45458 AR50077 IR55678 RO26491 RO27036 RO36860 RO43837 RO50077 RO53985 RO55023 RO59666 RO64729 RO65762 TR26491 TR27036 TR36860 TR41888 TR42119 TR43837 TR50077 TR53696 TR53985 TR54009 TR55023 TR59666 TR64729 TR65762 TR68320 TR69454 TR70478 TR70602 TR71376 ) ++HOLD (RO71376) SYSTEM FMID(CAKOF00) REASON (DYNACT ) DATE (14231) CA Top Secret for z/os Release 15.0 SEQUENCE After Apply PURPOSE Load module into LLA and activate USERS ALL KNOWLEDGE 1. Console commands REQUIRED 2. Top Secret administration ACCESS 1. Console authority REQUIRED 2. TSS administrative authority SMP APPLY, LLA REFRESH and restart CA Top Secret

8 CA Top Secret Security for z/os CA RS PTF RO RO71959 RO71959 M.C.S. ENTRIES = ++PTF (RO71959) S0C4 TSSCRVAL+246E ON A TD QUEUE JOB SUBMIT Under CTS, if an application issuing an 'CICS WRITEQ TD QUEUE', where the '//jobname JOB' control card resides within the program and the program is linked with the 'RENT' attribute, a S0C4 ABEND will occur in TSSCRVAL+246E. Also if job was submitted via Spoolwrite the region acid was associated with the job instead of the signon user. CAS9578E - Product = KO50 PSW = 078D0000 CC87F47E Completion code 0c4 After the S0C4 ABEND, the job will run under the region control acid. Jobs ran under the region acid instead of the signon user. Re-link the application with the 'NORENT' attribute. PRODUCT(S) AFFECTED: CA Top Secret for z/os Release 15.0 TSSMVS 9569 Copyright (C) 2014 CA. All rights reserved. R01012-TSS150-SP1 DESC(S0C4 TSSCRVAL+246E ON A TD QUEUE JOB SUBMIT FMID (CAKOF01) PRE ( RO26389 RO32608 RO35678 RO43979 RO44355 RO55378 RO64546 RO65248 RO69900 ) SUP ( TR23132 TR25733 AR23132 RO23132 TR26102 AR35678 RO25733 TR31788 TR38667 RO38667 TR46000 TR46119 RO46119 TR50439 AR50439 TR53765 RO50439 RO53765 TR64897 RO26102 TR69662 RO64897 RO69662 TR71263 TR71777 TR71959 ) ++HOLD (RO71959) SYSTEM FMID(CAKOF01) REASON (DYNACT ) DATE (14201) CA Top Secret for z/os CICS Component Release 15.0 SEQUENCE After Apply PURPOSE Load module into LLA and activate USERS All users that submit jobs via TD Que in CICS KNOWLEDGE 1- SMP/E 2- z/os Systems Programming REQUIRED 3- Security Administration ACCESS SMP/E CSI libraries REQUIRED SMP APPLY, LLA REFRESH, and recycle of the region is required to install this APAR.

9 CA Top Secret Security for z/os CA RS PTF RO RO72050 RO72050 M.C.S. ENTRIES = ++PTF (RO72050) SP-252 KEY-0 DEADMAIN STORAGE SAFCR712 A/RO63740 With CA Top Secret solution RO63740 implemented, the following problems can occur. If a large number of TSS ADD/REM/CHKCERT/EXPORT certificate commands that are encoded with a PKCS#12 or PKCS#7 package are issued, the following conditions can result: 1) Work area GETMAINED in SP-252 KEY=0 with an eye-catcher of SAFCR712 will only be partially freed. 2) This can result in the TSS address space running out of storage. S878 and out of storage condition. The TSS address space needs to be recycled. Recycle the Top Secret address space. PRODUCT(S) AFFECTED: TSSMVS Release 15.0 TSSMVS 9590 Copyright (C) 2014 CA. All rights reserved. R01014-TSS150-SP1 DESC(SP-252 KEY-0 DEADMAIN STORAGE SAFCR712 A/RO63740 FMID (CAKOF00) PRE ( RO25900 RO35644 RO36198 RO55678 RO63740 ) SUP ( DR63740 TR72050 ) ++HOLD (RO72050) SYSTEM FMID(CAKOF00) REASON (DYNACT ) DATE (14226) CA Top Secret for z/os Release 15.0 SEQUENCE Before Apply PURPOSE Load module into LLA and activate USERS All KNOWLEDGE 1. Console commands REQUIRED 2. Top Secret administration ACCESS 1. Console authority REQUIRED 2. TSS administrative authority SMP APPLY, LLA refresh, and 'F TSS,REFRESH(SAFAL)'

10 CA Top Secret Security for z/os CA RS PTF RO RO72234 RO72234 M.C.S. ENTRIES = ++PTF (RO72234) TSSCFILE ERROR ON TSS MODIFY(STATUS) Running CFILE get the following error on TSS MODIFY(STATUS) Unknown data encountered on next line: HFSSEC(ON ) CHOWN_RESTRICTED DISPMASK(OFF) Error only occurs for CHOWN_RESTRICTED. TSSCFILE gets error on TSS MODIFY(STATUS Unknown data encountered on next line: Some records are not produced for modify(status None PRODUCT(S) AFFECTED: CA Top Secret for z/os Release 15.0 TSSMVS 9594 Copyright (C) 2014 CA. All rights reserved. R01015-TSS150-SP1 DESC(TSSCFILE ERROR ON TSS MODIFY(STATUS) FMID (CAKOF00) PRE ( RO25587 RO36198 RO37109 RO43262 RO45811 RO55678 RO63150 RO63740 RO68239 RO70449 ) SUP ( TR48727 RO48727 TR72234 ) ++HOLD (RO72234) SYSTEM FMID(CAKOF00) REASON (DYNACT ) DATE (14225) CA Top Secret for z/os Release 15.0 SEQUENCE After Apply PURPOSE Recognize CHOWN_RESTRICTED in STATUS display. USERS All users that run TSSCFILE. KNOWLEDGE 1- SMP/E 2- z/os Systems Programming REQUIRED 3- Security Administration ACCESS SMP/E CSI libraries REQUIRED LLA Refresh and rerun TSSCFILE job.

11 CA Top Secret Security for z/os CA RS PTF RO RO72677 RO72677 M.C.S. ENTRIES = ++PTF (RO72677) TSS MAY LOOP WHEN PROCESSING RECOVERY CMD WITH AES The CA Top Secret command processor can go into a loop under the following conditions (all are required): 1) Run CA Top Secret recovery job (TSSRCVR2) that contains CA Top Secret CREATE commands. 2) Under a CA Top Secret file formatted with AES encryption. This problem has been reported when a CREATE command was executed from the TSSRCVR2 utility on a AES formatted Security File. This problem can occur with a PASSWORD or PASSPHRASE on the CREATE command. The problem is more likely to occur when the NAME field contains, at any position, characters 'PAS' or 'PHR'. TSSRCVR2 job may hang when applying recovery file commands to the active security file. The last ACID created may not have all intended fields. Looping job must be cancelled. The last partially updated ACID may need to be re-administered. For sites that are running with AES encryption and require to run forward recovery can perform the following steps: 1) Review the output CA Top Secret commands generated from TSSRCVR1. 2) Execute those commands in a batch job (not using TSSRCVR2 utility For sites that have run into this problem, the following steps can be performed: 1) View the output from the cancelled TSSRCVR2 job. Identify the last executed CREATE command. 2) Run the remaining commands starting with the last CREATE command using a batch job (not using the TSSRCVR2 utility PRODUCT(S) AFFECTED: CA-Top Secret Release 15.0 TSSMVS 9596 Copyright (C) 2014 CA. All rights reserved. R01017-TSS150-SP1 DESC(TSS MAY LOOP WHEN PROCESSING RECOVERY CMD WITH AES FMID (CAKOF00) PRE ( RO18634 RO19256 RO20497 RO21793 RO23523 RO25900 RO35644 RO36198 RO37109 RO38472 RO46203 RO50801 RO53633 RO55678 RO63150 RO63740 RO63941 RO69457 RO70449 ) SUP ( AR63740 CR63150 KR55678 RO18880 RO20230 RO20898 RO21191 RO28526 RO28778 RO32792 RO33282 RO38385 RO38784 RO38899 RO49662 RO57685 RO59203 RO59314 RO65717 RO65891 RO67089 RO68361 TR16894 TR16956 TR17040 TR17122 TR17596 TR18880 TR20230 TR20898 TR21191 TR28526 TR28778 TR29757 TR32792 TR33282 TR33505 TR33519 TR38385 TR38784 TR38899 TR49662 TR57685 TR59203 TR59314 TR65717 TR65891 TR67089 TR68361 TR72677 KC56243 ) ++HOLD (RO72677) SYSTEM FMID(CAKOF00) REASON (DYNACT ) DATE (14232) CA Top Secret for z/os Release 15.0 SEQUENCE After Apply PURPOSE Correct error parsing recovery file commands with AES password/phrase USERS All users that use AES encryption for passwords/phrases

12 CA Top Secret Security for z/os CA RS PTF RO72677 KNOWLEDGE 1- Product Administration REQUIRED 2- SMP/e 3- z/os Systems Programming 4- Security Administration ACCESS SMP/e CSI libraries REQUIRED LLA,REFRESH Recycle of TSS