RHEL 5 : JBoss EAP (RHSA-2013:0839)

This script is Copyright (C) 2013-2014 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing one or more security updates.

Description :

Updated JBoss Enterprise Application Platform 6.1.0 packages that fix
three security issues, various bugs, and add enhancements are now
available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS)
base scores, which give detailed severity ratings, are available for
each vulnerability from the CVE links in the References section.

JBoss Enterprise Application Platform 6 is a platform for Java
applications based on JBoss Application Server 7.

This release serves as a replacement for JBoss Enterprise Application
Platform 6.0.1, and includes bug fixes and enhancements. Refer to the
6.1.0 Release Notes for information on the most significant of these
changes, available shortly from
https://access.redhat.com/site/documentation/

Security fixes :

XML encryption backwards compatibility attacks were found against
various frameworks, including Apache CXF. An attacker could force a
server to use insecure, legacy cryptosystems, even when secure
cryptosystems were enabled on endpoints. By forcing the use of legacy
cryptosystems, flaws such as CVE-2011-1096 and CVE-2011-2487 would be
exposed, allowing plain text to be recovered from cryptograms and
symmetric keys. (CVE-2012-5575)

Note: Automatic checks to prevent CVE-2012-5575 are only run when
WS-SecurityPolicy is used to enforce security requirements. It is best
practice to use WS-SecurityPolicy to enforce security requirements.

When applications running on JBoss Web used the COOKIE session
tracking method, the
org.apache.catalina.connector.Response.encodeURL() method returned the
URL with the jsessionid appended as a query string parameter when
processing the first request of a session. An attacker could possibly
exploit this flaw by performing a man-in-the-middle attack to obtain a
user's jsessionid and hijack their session, or by extracting the
jsessionid from log files. Note that no session tracking method is
used by default, one must be configured. (CVE-2012-4529)

If multiple applications used the same custom authorization module
class name, and provided their own implementations of it, the first
application to be loaded will have its implementation used for all
other applications using the same custom authorization module class
name. A local attacker could use this flaw to deploy a malicious
application that provides implementations of custom authorization
modules that permit or deny user access according to rules supplied by
the attacker. (CVE-2012-4572)

Red Hat would like to thank Tibor Jager, Kenneth G. Paterson and Juraj
Somorovsky of Ruhr-University Bochum for reporting CVE-2012-5575.
CVE-2012-4572 was discovered by Josef Cacek of the Red Hat JBoss EAP
Quality Engineering team.

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation and deployed
applications. Refer to the Solution section for further details.

All users of JBoss Enterprise Application Platform 6.0.1 on Red Hat
Enterprise Linux 5 are advised to upgrade to these updated packages.
The JBoss server process must be restarted for the update to take
effect.

See also :

https://www.redhat.com/security/data/cve/CVE-2012-4529.html
https://www.redhat.com/security/data/cve/CVE-2012-4572.html
https://www.redhat.com/security/data/cve/CVE-2012-5575.html
https://access.redhat.com/site/documentation/
http://cxf.apache.org/cve-2012-5575.html
http://rhn.redhat.com/errata/RHSA-2013-0839.html

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 6.8
(CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS Temporal Score : 5.9
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : false

Family: Red Hat Local Security Checks

Nessus Plugin ID: 66523 ()

Bugtraq ID: 60040
60043
60045

CVE ID: CVE-2012-4529
CVE-2012-4572
CVE-2012-5575
CVE-2013-2067