How-to upgrade tomcat to latest version to remediate vulnerabilities

Products

• CA Advanced Authentication
• CA Strong Authentication
• CA Risk Authentication

Issue/Introduction

Tomcat 7 is running within our AA infrastructure (webfort/riskfort) with customization from GD. We need to upgrade our tomcat to minimum 7.0.90 on internal and external environment in order to mitigate vulnerabilities.  

Environment

CA Advanced Authentication Internal (Employee) Environment – Risk Engine Version: 8.1.3 External (Customer) Environment – Risk Engine Version: 3.1.01, WebFort 7.1.01
Applicable to CA AA 8.2.1

Resolution

CA AuthMinder / CA Strong Authentication Admin console deployed on Tomcat application uses ArcotAccessKeyProvider.so/dll and arcot-crypto-util.jar files to read the contents of the securestore.enc file which is used for database connectivity purpose. These files are placed at a specified location in JAVA directory used by Tomcat server for startup. Once Tomcat is upgraded make sure to use the same Java as used in previous version.
To upgrade Tomcat follow the below steps-

1. Stop the Tomcat application server.
2. Take backup of the TOMCAT_HOME/webapps directory
3. Upgrade your Tomcat to desired version by following the vendor documentation
4. Copy the JDBC JAR file and paste in the following directory TOMCAT_HOME/lib directory.
5. Redeploy the war files again to the TOMCAT_HOME/webapps directory.
6. Restart the Tomcat Application server.
7. Validate the applications functionalities.

Note --> If you are upgrading the Java as well then follow the tech doc "Auth Minder Admin console is not coming up after Java Upgrade" by searching on internet.