The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 through 4.3.0.CP09, and 5.1.0; and JBoss Enterprise Web Platform (aka JBEWP) 5.1.0; allows remote attackers to cause a denial of service (daemon outage) by establishing a bisocket control connection TCP session, and then not sending any application data.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2010:0961 advisory.

    The Enterprise Web Platform is for mid-size workloads, focusing on light     and rich Java applications. Web Platform is a slimmed down profile of the     JBoss Enterprise Application Platform.

    A flaw was found in the JBoss Remoting component. A remote attacker could     use specially-crafted input to cause the JBoss Remoting listeners to become     unresponsive, resulting in a denial of service condition for services     communicating via JBoss Remoting sockets. (CVE-2010-3862)

    Red Hat would like to thank Ole Husgaard of eXerp.com for reporting this     issue.

    These updated packages include multiple bug fixes. Documentation for these     bug fixes will be available shortly from the Release Notes, linked to in     the References section.

    As well, this update adds a new jbossws-cxf package to JBoss Enterprise     Web Platform 5.1, to provide the sources for jbossws-cxf. (BZ#645465)

    Warning: Before applying this update, please backup the JBoss Enterprise     Web Platform jboss-as-web/server/$PROFILE/deploy/ directory, along with     all other customized configuration files.

    All users of JBoss Enterprise Web Platform on Red Hat Enterprise Linux 4     and 5 are advised to upgrade to these updated packages. The JBoss server     process must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated JBoss Enterprise Application Platform 5.1 packages that fix one security issue and various bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

JBoss Enterprise Application Platform is the market leading platform for innovative and scalable Java applications; integrating the JBoss Application Server, with JBoss Hibernate and JBoss Seam into a complete, simple enterprise solution.

A flaw was found in the JBoss Remoting component. A remote attacker could use specially crafted input to cause the JBoss Remoting listeners to become unresponsive, resulting in a denial of service condition for services communicating via JBoss Remoting sockets.
(CVE-2010-3862)

Red Hat would like to thank Ole Husgaard of eXerp.com for reporting this issue.

These updated packages include multiple bug fixes. Documentation for these bug fixes will be available shortly from the Release Notes, linked to in the References section.

As well, this update adds a new jbossws-cxf package to JBoss Enterprise Application Platform 5.1.0, to provide the sources for jbossws-cxf. (BZ#645470)

Warning: Before applying this update, please backup the JBoss Enterprise Application Platform 'jboss-as/server/$PROFILE/deploy/' directory, along with all other customized configuration files.

All users of JBoss Enterprise Application Platform 5.0 on Red Hat Enterprise Linux 5 are advised to upgrade to these updated packages.
The JBoss server process must be restarted for the update to take effect.

Updated JBoss Enterprise Application Platform 5.1 packages that fix one security issue and various bugs are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

JBoss Enterprise Application Platform is the market leading platform for innovative and scalable Java applications; integrating the JBoss Application Server, with JBoss Hibernate and JBoss Seam into a complete, simple enterprise solution.

A flaw was found in the JBoss Remoting component. A remote attacker could use specially crafted input to cause the JBoss Remoting listeners to become unresponsive, resulting in a denial of service condition for services communicating via JBoss Remoting sockets.
(CVE-2010-3862)

Red Hat would like to thank Ole Husgaard of eXerp.com for reporting this issue.

These updated packages include multiple bug fixes. Documentation for these bug fixes will be available shortly from the Release Notes, linked to in the References section.

As well, this update adds a new jbossws-cxf package to JBoss Enterprise Application Platform 5.1.0, to provide the sources for jbossws-cxf. (BZ#644403)

Warning: Before applying this update, please backup the JBoss Enterprise Application Platform 'jboss-as/server/$PROFILE/deploy/' directory, along with all other customized configuration files.

All users of JBoss Enterprise Application Platform 5.0 on Red Hat Enterprise Linux 4 are advised to upgrade to these updated packages.
The JBoss server process must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0938 advisory.

    JBoss Enterprise Application Platform is the market leading platform for     innovative and scalable Java applications; integrating the JBoss     Application Server, with JBoss Hibernate and JBoss Seam into a complete,     simple enterprise solution.

    This release of JBEAP for Red Hat Enterprise Linux 5 serves as a     replacement to JBEAP 4.3.0.CP08.

    These updated packages include multiple bug fixes which are detailed in the     Release Notes. The Release Notes will be available shortly from the link in     the References section.

    The following security issues are also fixed with this release:

    An input sanitization flaw was found in the way JBoss Drools implemented     certain rule base serialization. If a remote attacker supplied     specially-crafted input to a JBoss Seam based application that accepts     serialized input, it could lead to arbitrary code execution with the     privileges of the JBoss server process. (CVE-2010-3708)

    A Cross-Site Request Forgery (CSRF) flaw was found in the JMX Console. A     remote attacker could use this flaw to deploy a WAR file of their choosing     on the target server, if they are able to trick a user, who is logged into     the JMX Console as the admin user, into visiting a specially-crafted web     page. (CVE-2010-3878)

    A flaw was found in the JBoss Remoting component. A remote attacker could     use specially-crafted input to cause the JBoss Remoting listeners to become     unresponsive, resulting in a denial of service condition for services     communicating via JBoss Remoting sockets. (CVE-2010-3862)

    Red Hat would like to thank Ole Husgaard of eXerp.com for reporting the     CVE-2010-3862 issue.

    Warning: Before applying this update, please backup the JBEAP     server/[configuration]/deploy/ directory, and any other customized     configuration files.

    All users of JBEAP 4.3 on Red Hat Enterprise Linux 5 are advised to upgrade     to these updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated JBoss Enterprise Application Platform (JBEAP) 4.3 packages that fix three security issues and multiple bugs are now available for Red Hat Enterprise Linux 4 as JBEAP 4.3.0.CP09.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

JBoss Enterprise Application Platform is the market leading platform for innovative and scalable Java applications; integrating the JBoss Application Server, with JBoss Hibernate and JBoss Seam into a complete, simple enterprise solution.

This release of JBEAP for Red Hat Enterprise Linux 4 serves as a replacement to JBEAP 4.3.0.CP08.

These updated packages include multiple bug fixes which are detailed in the Release Notes. The Release Notes will be available shortly from the link in the References section.

The following security issues are also fixed with this release :

An input sanitization flaw was found in the way JBoss Drools implemented certain rule base serialization. If a remote attacker supplied specially crafted input to a JBoss Seam based application that accepts serialized input, it could lead to arbitrary code execution with the privileges of the JBoss server process.
(CVE-2010-3708)

A Cross-Site Request Forgery (CSRF) flaw was found in the JMX Console.
A remote attacker could use this flaw to deploy a WAR file of their choosing on the target server, if they are able to trick a user, who is logged into the JMX Console as the admin user, into visiting a specially crafted web page. (CVE-2010-3878)

A flaw was found in the JBoss Remoting component. A remote attacker could use specially crafted input to cause the JBoss Remoting listeners to become unresponsive, resulting in a denial of service condition for services communicating via JBoss Remoting sockets.
(CVE-2010-3862)

Red Hat would like to thank Ole Husgaard of eXerp.com for reporting the CVE-2010-3862 issue.

Warning: Before applying this update, please backup the JBEAP 'server/[configuration]/deploy/' directory, and any other customized configuration files.

All users of JBEAP 4.3 on Red Hat Enterprise Linux 4 are advised to upgrade to these updated packages.

ID	Name	Product	Family	Severity
210172	RHEL 5 : JBoss Enterprise Web Platform 5.1.0 (RHSA-2010:0961)	Nessus	Red Hat Local Security Checks	high
63964	RHEL 5 : JBoss EAP (RHSA-2010:0960)	Nessus	Red Hat Local Security Checks	low
63963	RHEL 4 : JBoss EAP (RHSA-2010:0959)	Nessus	Red Hat Local Security Checks	low
63962	RHEL 5 : JBoss Enterprise Application Platform 4.3.0.CP09 update (Important) (RHSA-2010:0938)	Nessus	Red Hat Local Security Checks	high
63961	RHEL 4 : JBoss EAP (RHSA-2010:0937)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2010-3862

high

Tenable Plugins

high

low

low

high

high