Title

IBM Security zSecure must remove all upgraded/replaced zSecure software components that are no longer required for operation after updated versions have been installed. (Cat II impact)

Discussion

Previous versions of zSecure products and components that are not removed from the information system after updates have been installed may be exploited by adversaries. Some information technology products may remove older versions of software automatically from the information system.

Check Content

Examine the inventory of installed software components for zSecure. If software components that are no longer required for operation exist, this is a finding.

Fix Text

Remove all upgraded/replaced software components that are no longer required for operation.

Additional Identifiers

Rule ID: SV-259736r961677_rule

Vulnerability ID: V-259736

Group Title: SRG-APP-000454-MFP-000343

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.