Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the
    requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
    (CVE-2015-0227)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0848 advisory.

    Red Hat JBoss Enterprise Application Platform 6 is a platform for Java     applications based on JBoss Application Server 7.

    It was found that a prior countermeasure in Apache WSS4J for     Bleichenbacher's attack on XML Encryption (CVE-2011-2487) threw an     exception that permitted an attacker to determine the failure of the     attempted attack, thereby leaving WSS4J vulnerable to the attack.
    The original flaw allowed a remote attacker to recover the entire plain     text form of a symmetric key. (CVE-2015-0226)

    A flaw was found in the way PicketLink's Service Provider and Identity     Provider handled certain requests. A remote attacker could use this flaw to     log to a victim's account via PicketLink. (CVE-2015-0277)

    It was discovered that a JkUnmount rule for a subtree of a previous JkMount     rule could be ignored. This could allow a remote attacker to potentially     access a private artifact in a tree that would otherwise not be accessible     to them. (CVE-2014-8111)

    It was found that Apache WSS4J permitted bypass of the     requireSignedEncryptedDataElements configuration property via XML Signature     wrapping attacks. A remote attacker could use this flaw to modify the     contents of a signed request. (CVE-2015-0227)

    It was found that the Command Line Interface, as provided by Red Hat     Enterprise Application Platform, created a history file named     .jboss-cli-history in the user's home directory with insecure default file     permissions. This could allow a malicious local user to gain information     otherwise not accessible to them. (CVE-2014-3586)

    The CVE-2015-0277 issue was discovered by Ondrej Kotek of Red Hat.

    This release of JBoss Enterprise Application Platform also includes bug     fixes and enhancements. Documentation for these changes will be available     shortly from the JBoss Enterprise Application Platform 6.4.0 Release Notes,     linked to in the References.

    All users who require JBoss Enterprise Application Platform 6.4.0 on Red     Hat Enterprise Linux 7 should install these new packages. The JBoss server     process must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0847 advisory.

    Red Hat JBoss Enterprise Application Platform 6 is a platform for Java     applications based on JBoss Application Server 7.

    It was found that a prior countermeasure in Apache WSS4J for     Bleichenbacher's attack on XML Encryption (CVE-2011-2487) threw an     exception that permitted an attacker to determine the failure of the     attempted attack, thereby leaving WSS4J vulnerable to the attack.
    The original flaw allowed a remote attacker to recover the entire plain     text form of a symmetric key. (CVE-2015-0226)

    It was found that Apache WSS4J permitted bypass of the     requireSignedEncryptedDataElements configuration property via XML Signature     wrapping attacks. A remote attacker could use this flaw to modify the     contents of a signed request. (CVE-2015-0227)

    It was discovered that a JkUnmount rule for a subtree of a previous JkMount     rule could be ignored. This could allow a remote attacker to potentially     access a private artifact in a tree that would otherwise not be accessible     to them. (CVE-2014-8111)

    A flaw was found in the way PicketLink's Service Provider and Identity     Provider handled certain requests. A remote attacker could use this flaw to     log to a victim's account via PicketLink. (CVE-2015-0277)

    It was found that the Command Line Interface, as provided by Red Hat     Enterprise Application Platform, created a history file named     .jboss-cli-history in the user's home directory with insecure default file     permissions. This could allow a malicious local user to gain information     otherwise not accessible to them. (CVE-2014-3586)

    The CVE-2015-0277 issue was discovered by Ondrej Kotek of Red Hat.

    This release of JBoss Enterprise Application Platform also includes bug     fixes and enhancements. Documentation for these changes will be available     shortly from the JBoss Enterprise Application Platform 6.4.0 Release Notes,     linked to in the References.

    All users who require JBoss Enterprise Application Platform 6.4.0 on Red     Hat Enterprise Linux 6 should install these new packages. The JBoss server     process must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0846 advisory.

    Red Hat JBoss Enterprise Application Platform 6 is a platform for Java     applications based on JBoss Application Server 7.

    It was found that a prior countermeasure in Apache WSS4J for     Bleichenbacher's attack on XML Encryption (CVE-2011-2487) threw an     exception that permitted an attacker to determine the failure of the     attempted attack, thereby leaving WSS4J vulnerable to the attack.
    The original flaw allowed a remote attacker to recover the entire plain     text form of a symmetric key. (CVE-2015-0226)

    It was found that Apache WSS4J permitted bypass of the     requireSignedEncryptedDataElements configuration property via XML Signature     wrapping attacks. A remote attacker could use this flaw to modify the     contents of a signed request. (CVE-2015-0227)

    It was discovered that a JkUnmount rule for a subtree of a previous JkMount     rule could be ignored. This could allow a remote attacker to potentially     access a private artifact in a tree that would otherwise not be accessible     to them. (CVE-2014-8111)

    A flaw was found in the way PicketLink's Service Provider and Identity     Provider handled certain requests. A remote attacker could use this flaw to     log to a victim's account via PicketLink. (CVE-2015-0277)

    It was found that the Command Line Interface, as provided by Red Hat     Enterprise Application Platform, created a history file named     .jboss-cli-history in the user's home directory with insecure default file     permissions. This could allow a malicious local user to gain information     otherwise not accessible to them. (CVE-2014-3586)

    The CVE-2015-0277 issue was discovered by Ondrej Kotek of Red Hat.

    This release of JBoss Enterprise Application Platform also includes bug     fixes and enhancements. Documentation for these changes will be available     shortly from the JBoss Enterprise Application Platform 6.4.0 Release Notes,     linked to in the References.

    All users who require JBoss Enterprise Application Platform 6.4.0 on Red     Hat Enterprise Linux 5 should install these new packages. The JBoss server     process must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
411600	SCA: security update for org.apache.ws.security:wss4j, wss4j:wss4j (GHSA-6r5v-hp32-fjqw)	Tenable Cloud Security	SCA Checks	medium
411600	SCA: security update for org.apache.ws.security:wss4j, wss4j:wss4j (GHSA-6r5v-hp32-fjqw)	Tenable Self-Hosted Container Security	SCA Checks	medium
112239	RHEL 7 : Red Hat JBoss Enterprise Application Platform 6.4.0 update (Important) (RHSA-2015:0848)	Nessus	Red Hat Local Security Checks	high
82896	RHEL 6 : Red Hat JBoss Enterprise Application Platform 6.4.0 update (Important) (RHSA-2015:0847)	Nessus	Red Hat Local Security Checks	high
82895	RHEL 5 : Red Hat JBoss Enterprise Application Platform 6.4.0 update (Important) (RHSA-2015:0846)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2015-0227

medium

Tenable Plugins

medium

medium

high

high

high