JBoss Enterprise Application Platform 6.1.1 Update (RHSA-2013:1209)

Medium Nessus Plugin ID 72238


The remote Red Hat host is missing a security update.


The version of JBoss Enterprise Application Platform installed on the remote system is affected by the following issues :

- Flaws in the mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp modules can allow an attacker to perform cross-site scripting (XSS) attacks.

- Flaws in the web interface of the mod_proxy_balancer module can allow a remote attacker to perform XSS attacks. (CVE-2012-4558)

- A flaw in mod_rewrite can allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.

- A flaw in the method by which the mod_dav module handles merge requests can allow an attacker to create a denial of service by sending a crafted merge request that contains URIs that are not configured for DAV.

- A flaw in PicketBox can allow local users to obtain the admin encryption key by reading the Vault data file.

- A flaw in Apache Santuario XML Security can allow context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak algorithm. (CVE-2013-2172)

- A flaw in JGroup's DiagnosticsHandler can allow remote attackers to obtain sensitive information and execute arbitrary code by re-using valid credentials.


Upgrade the installed JBoss Enterprise Application Platform 6.1.0 to 6.1.1 or later.

See Also








Plugin Details

Severity: Medium

ID: 72238

File Name: redhat-RHSA-2013-1209.nasl

Version: $Revision: 1.3 $

Type: local

Agent: unix

Published: 2014/01/31

Modified: 2015/02/13

Dependencies: 12634, 72202

Risk Information

Risk Factor: Medium


Base Score: 5.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:redhat:jboss_enterprise_application_platform:6.1.0

Required KB Items: Host/local_checks_enabled, Host/RedHat/release

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2013/09/04

Vulnerability Publication Date: 2012/02/18

Reference Information

CVE: CVE-2012-3499, CVE-2012-4558, CVE-2013-1862, CVE-2013-1896, CVE-2013-1921, CVE-2013-2172, CVE-2013-4112

BID: 58165, 59826, 60846, 61129, 61179, 62256

OSVDB: 90556, 90557, 93366, 94651, 95386, 95498, 96980

RHSA: 2013:1209

CWE: 20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990