Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client.

The version of JBoss Enterprise Application Platform running on the remote system is vulnerable to the following issues:

  - A flaw in the way authenticated connections are cached     on the server by remote-naming could allow a remote     attacker to log in as another user without knowing     their password. (CVE-2013-4128)

  - A flaw in the way connections for remote EJB     invocations via the EJB client API are cached on the     server could allow a remote attacker to use an EJB     client to log in as another user without knowing their     password. (CVE-2013-4213)

The version of JBoss Enterprise Portal Platform on the remote system is affected by the following issues:

  - A flaw in CSRF prevention filter in JBoss Web could allow     remote attackers to bypass the cross-site request forgery     (CSRF) protection mechanism via a request that lacks a     session identifier. (CVE-2012-4431)

  - A flaw that occurs when the COOKIE session tracking     method is used can allow attackers to hijack users'     sessions. (CVE-2012-4529)

  - A flaw that occurs when multiple applications use the     same custom authorization module class name can allow a     local attacker to deploy a malicious application that     overrides the custom authorization modules provided by     other applications. (CVE-2012-4572)

  - The framework does not verify that a specified     cryptographic algorithm is allowed by the     WS-SecurityPolicy AlgorithmSuite definition before     decrypting.  This can allow remote attackers to force     the system to use weaker cryptographic algorithms than     intended and makes it easier to decrypt communications.
    (CVE-2012-5575)

  - A flaw in PicketBox can allow local users to obtain the     admin encryption key by reading the Vault data file.
    (CVE-2013-1921)

  - A session fixation flaw was found in the     FormAuthenticator module. (CVE-2013-2067)

  - A flaw that occurs when a JGroups channel was started     results in the JGroups diagnostics service being enabled     by default with no authentication via IP multicast. A     remote attacker can make use of this flaw to read     diagnostics information. (CVE-2013-2102)

  - A flaw in the StAX parser implementation can allow     remote attackers to cause a denial of service via     crafted XML. (CVE-2013-2160)

  - A flaw in Apache Santuario XML Security can allow     context-dependent attackers to spoof an XML Signature     by using the CanonicalizationMethod parameter to     specify an arbitrary weak algorithm. (CVE-2013-2172)

  - A flaw in JGroup's DiagnosticsHandler can allow remote     attackers to obtain sensitive information and execute     arbitrary code by re-using valid credentials.
    (CVE-2013-4112)

  - A flaw in the manner in which authenticated connections     were cached on the server by remote-naming can allow     remote attackers to hijack sessions by using a remoting     client. (CVE-2013-4128)

  - A flaw in the manner in which connections for EJB     invocations were cached on the server can allow remote     attackers to hijack sessions by using an EJB client.
    (CVE-2013-4213)

Updated Red Hat JBoss Enterprise Application Platform 6.1.0 packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7.

A flaw was discovered in the way authenticated connections were cached on the server by remote-naming. After a user has successfully logged in, a remote attacker could use a remoting client to log in as that user without knowing their password, allowing them to access data and perform actions with the privileges of that user. (CVE-2013-4128)

A flaw was discovered in the way connections for remote EJB invocations via the EJB client API were cached on the server. After a user has successfully logged in, a remote attacker could use an EJB client to log in as that user without knowing their password, allowing them to access data and perform actions with the privileges of that user. (CVE-2013-4213)

These issues were discovered by Wolf-Dieter Fink of the Red Hat GSS Team.

Warning: Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

All users of Red Hat JBoss Enterprise Application Platform 6.1.0 on Red Hat Enterprise Linux 5 and 6 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect.

ID	Name	Product	Family	Severity
72261	Red Hat JBoss Enterprise Application Platform 6.1.0 Security Update (RHSA-2013:1152)	Nessus	Red Hat Local Security Checks	medium
72237	JBoss Portal 6.1.0 Update (RHSA-2013:1437)	Nessus	Red Hat Local Security Checks	high
69315	RHEL 5 / 6 : JBoss EAP (RHSA-2013:1151)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2013-4213

critical

Tenable Plugins

medium

high

medium