Due to the fix for security APAR IT25813 wsdbu01349804
[SECURITY: ADMINISTRATIVE TASK SCHEDULER IS VULNERABLE TO A
PRIVILEGE ESCALATION], customer receives -607 errors when
trying execute ATS stored procedure tasks due to ATS package
using an authorization ID other than SYSIBM. The affected ATS
procedures are
SYSPROC.ADMIN_TASK_ADD/ADMIN_TASK_REMOVE/ADMIN_TASK_UPDATE.
The current authorization ID for the ATS package can be verified
by issuing the following SQL statement and looking at the
BOUNDBY value: "SELECT PKGSCHEMA, PKGNAME, BOUNDBY FROM
SYSCAT.PACKAGES WHERE PKGNAME LIKE 'ATS%'"
The value of the BOUNDBY value can be changed away from SYSIBM
through explicit binding of the db2ats_sps.bnd or db2ubind.lst
files. If the bind of the db2ats_sps.bnd file is successful, the
BOUNDBY will be changed to the current session authorization ID.
If the bind fails with a -607 error, then the BOUNDBY value will
not be changed and ATS processing will not be affected.
This APAR will implement logic to have Db2 automatically
validate and, if necessary, restore the authorization ID for ATS
when an ATS stored procedure is invoked.
Note that attempts by customer to bind the db2ats_sps.bnd file
when the ATS control tables exist in the database will still
continue to fail with a -607 error even after applying this
APAR. This is the new, expected behaviour.
The customer may receive the following error during a bind:
SQL0082C An error has occurred which has terminated processing. |
