The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss
    Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to
    arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.
    NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a
    vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid
    providing untrusted data to be deserialized, or whether this class should inherently protect against this
    issue (CVE-2013-2185)

An updated jbossweb package that fixes one security issue is now available for Red Hat JBoss Enterprise Application Platform 6.1.0 for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

JBoss Web is the web container, based on Apache Tomcat, in Red Hat JBoss Enterprise Application Platform. It provides a single deployment platform for the JavaServer Pages (JSP) and Java Servlet technologies.

A flaw was found in the way the DiskFileItem class handled NULL characters in file names. A remote attacker able to supply a serialized instance of the DiskFileItem class, which will be deserialized on a server, could use this flaw to write arbitrary content to any location on the server that is accessible to the user running the application server process. (CVE-2013-2185)

Warning: Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

All users of Red Hat JBoss Enterprise Application Platform 6.1.0 on Red Hat Enterprise Linux 5 and 6 are advised to upgrade to this updated package. The JBoss server process must be restarted for the update to take effect.

ID	Name	Product	Family	Type	Severity
419119	SCA: security update for org.apache.tomcat:tomcat (GHSA-v6c7-8qx5-8gmp)	Tenable Cloud Security	SCA Checks	Local	high
419119	SCA: security update for org.apache.tomcat:tomcat (GHSA-v6c7-8qx5-8gmp)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
69778	RHEL 5 / 6 : jbossweb (RHSA-2013:1193)	Nessus	Red Hat Local Security Checks	Local	high

Detections

Analytics

CVE-2013-2185

high

Tenable Plugins

high

high

high