RHEL 4 / 5 / 6 : JBoss EAP (RHSA-2014:1726)

Medium Nessus Plugin ID 78735


The remote Red Hat host is missing a security update.


Updated packages for Red Hat JBoss Enterprise Application Platform 5.2.0 that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Red Hat JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam.

It was discovered that the Apache Santuario XML Security for Java project allowed Document Type Definitions (DTDs) to be processed when applying Transforms even when secure validation was enabled. A remote attacker could use this flaw to exhaust all available memory on the system, causing a denial of service. (CVE-2013-4517)

All users of Red Hat JBoss Enterprise Application Platform 5.2.0 on Red Hat Enterprise Linux 4, 5, and 6 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect.


Update the affected xml-security package.

See Also



Plugin Details

Severity: Medium

ID: 78735

File Name: redhat-RHSA-2014-1726.nasl

Version: $Revision: 1.6 $

Type: local

Agent: unix

Published: 2014/10/30

Modified: 2017/01/06

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 4.3

Temporal Score: 3.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:xml-security, cpe:/o:redhat:enterprise_linux:4, cpe:/o:redhat:enterprise_linux:5, cpe:/o:redhat:enterprise_linux:6

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2014/10/28

Reference Information

CVE: CVE-2013-4517

OSVDB: 101169

RHSA: 2014:1726