Synopsis

Moderate: JBoss Enterprise Application Platform 4.3.0CP01 security update

Type/Severity

Security Advisory: Moderate

Topic

Updated JBoss Enterprise Application Platform (JBoss EAP) packages that fix
various security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

JBoss EAP is a middleware platform for Java 2 Platform, Enterprise Edition
(J2EE) applications.

This release of JBoss EAP for Red Hat Enterprise Linux 5 contains the JBoss
Application Server and JBoss Seam. This release serves as a replacement to
JBoss EAP 4.3.0.GA, and fixes the following security issues:

The JavaServer Faces (JSF) component was vulnerable to multiple cross-site
scripting (XSS) vulnerabilities. An attacker could use these flaws to
inject arbitrary web script or HTML. (CVE-2008-1285)

Unauthenticated users were able to access the status servlet, which could
allow remote attackers to acquire details about deployed web contexts.
(CVE-2008-3273)

These updated packages include bug fixes and enhancements which are not
listed here. For a full list, refer to the JBoss EAP 4.3.0.CP01 release
notes, linked to in the "References" section of this advisory.

Warning: before applying this update, please back up the JBoss EAP
"server/[configuration]/deploy/" directory, and any customized
configuration files.

All users of JBoss EAP on Red Hat Enterprise Linux 5 are advised to upgrade
to these updated packages, which resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• JBoss Enterprise Application Platform 4.3.0 x86_64
• JBoss Enterprise Application Platform 4.3.0 i386

Fixes

• BZ - 437082 - CVE-2008-1285 Cross-site scripting (XSS) vulnerability in Sun Java Server Faces
• BZ - 457757 - CVE-2008-3273 JBossEAP status servlet info leak

CVEs

• CVE-2008-1285
• CVE-2008-3273

References

• http://redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3.0.cp01/html-single/readme/
• http://www.redhat.com/security/updates/classification/#moderate

JBoss Enterprise Application Platform 4.3.0

SRPM
asm-1.5.3-1jpp.ep1.2.el5.src.rpm	SHA-256: 74038cf01a54bdcd5f07aa284065ed97c1d0504dd9319e973c7f8fb84ad99499
cglib-2.1.3-2jpp.ep1.6.el5.src.rpm	SHA-256: 5c127115788c9f904e18649a5e651dbc3f1a8616af04580b8edab7b6799463c0
concurrent-1.3.4-8jpp.ep1.6.el5.1.src.rpm	SHA-256: 7dfa98ca5b4ac15afd4b66a0a308c8b99a7d007e72b299286eae6d2f248a43b1
glassfish-jaf-1.1.0-0jpp.ep1.11.el5.1.src.rpm	SHA-256: a21b1bc0b41bd3013c9ed7d397211728c441168ea4710dd7ab8d4189c0967609
glassfish-javamail-1.4.0-0jpp.ep1.9.el5.src.rpm	SHA-256: 1bcf1eb2147ab170d58d98bbea64f9bb9bb5d0122999560949962283b3be35ae
glassfish-jsf-1.2_08-0jpp.ep1.2.el5.src.rpm	SHA-256: 5c88d394d557f8d0ad976ec451d8267505a0d08232c2fbe87c56782a1b230718
hibernate3-3.2.4-1.SP1_CP03.0jpp.ep1.1.el5.src.rpm	SHA-256: 01f18e10f1f37423175d86668111e3a0a660f4d27df50c77d360bcf0c853baec
hibernate3-annotations-3.2.1-1.patch02.1jpp.ep1.3.el5.1.src.rpm	SHA-256: 9b34a692b072762c08eff415d63de20233f42184f451def4767d0758266e442a
hibernate3-entitymanager-3.2.1-1jpp.ep1.7.el5.src.rpm	SHA-256: e860e87bba090e7e7f8e5b5a19d95939fad3c3256eadcb73a4337711f9f33073
jboss-aop-1.5.5-1.CP01.0jpp.ep1.1.el5.src.rpm	SHA-256: 3402d42c479efc0ff9de08cbb6f4f78e11d44af12db96c28a700e84f051f14b3
jboss-cache-1.4.1-4.SP9.1jpp.ep1.1.el5.src.rpm	SHA-256: a0273ff4e1156d73c20b66d773d61de1b2cd37f596708e22d6da6f4d261362ae
jboss-messaging-1.4.0-1.SP3_CP02.0jpp.ep1.6.el5.src.rpm	SHA-256: 4e953c5844c4b340aa720296bbd92f1c6948a6a3300899ccdc91e4a0aaeb676f
jboss-remoting-2.2.2-3.SP7.0jpp.ep1.3.el5.src.rpm	SHA-256: 191a890ab7d831d5a5ff84f6af433f1e017bd2f37f286837fd191f4b0f1a4302
jboss-seam-1.2.1-3.JBPAPP_4_3_0_GA.ep1.5.el5.1.src.rpm	SHA-256: 0942cff8d47f0b4077f4587f61c5acfa5d1aed8e7aff731607cb616e693bd6bd
jbossas-4.3.0-2.GA_CP01.ep1.6.el5.1.src.rpm	SHA-256: 3015766464342f2eb833ccdb78d2401f24872efa658fc34b1b0fb240229a729f
jbossts-4.2.3-1.SP5_CP01.1jpp.ep1.1.el5.src.rpm	SHA-256: f1f62a9280f55ffbb6654fcd288062f0154d58c091e0c26ac548db2dc604e5f6
jbossws-2.0.1-2.SP2_CP01.0jpp.ep1.2.el5.src.rpm	SHA-256: 8310758fa7345b6f3d7aae91eac8103840e78574e242de944a8f997900fb71b9
jbossxb-1.0.0-2.SP1.0jpp.ep1.2.el5.1.src.rpm	SHA-256: 72729b5df74f4fb10d46b90ffac61f359e321af34e7bd7bad20c1affc8e3e608
jcommon-1.0.12-1jpp.ep1.3.el5.src.rpm	SHA-256: acd95b0b459fff08c2bc002990c8e43764faee7cada49fdb4ac0b9372ad9fc94
jfreechart-1.0.9-1jpp.ep1.3.el5.1.src.rpm	SHA-256: a2ad2042feb1097c5e82a57af61ccf68ac27f122a6d15ba4d90c83174f76565f
jgroups-2.4.2-1.GA_CP01.0jpp.ep1.1.el5.src.rpm	SHA-256: 205437b629077067080585d54a79e219320c78384c9f615874a2b22930194486
rh-eap-docs-4.3.0-2.GA_CP01.ep1.4.el5.src.rpm	SHA-256: 3747761e6067710a065cee1cc91142ac9fc3b9f1bc39ea5892ddcd15d4d07bdc
x86_64
asm-1.5.3-1jpp.ep1.2.el5.noarch.rpm	SHA-256: 2c1d5b3eb0f4eb6b58788c6fd050b05090c5f3bdec5b59e449dcbe5687d8be3c
cglib-2.1.3-2jpp.ep1.6.el5.noarch.rpm	SHA-256: 9c7494ee8e8789cd995755da4baafb4963af439705127b4833629acf45665f63
concurrent-1.3.4-8jpp.ep1.6.el5.1.noarch.rpm	SHA-256: 8eff549f24f6aa3c00c7cc42d5f94b46d3eb8747d1f97fa25f5e090b3490e16e
glassfish-jaf-1.1.0-0jpp.ep1.11.el5.1.noarch.rpm	SHA-256: d0208e5600ccde6f935151c460e440b1e85079c98cc9881f3a3427e2c205e44d
glassfish-javamail-1.4.0-0jpp.ep1.9.el5.noarch.rpm	SHA-256: 4526a1f283f92c9270685e4c68cf3e4825f5451f1014660dfefe612062cd552b
glassfish-jsf-1.2_08-0jpp.ep1.2.el5.noarch.rpm	SHA-256: c0080aa73826e1338a6a4d9de7191223619d9730c2350c45cdd3cbb28358bf93
hibernate3-annotations-3.2.1-1.patch02.1jpp.ep1.3.el5.1.noarch.rpm	SHA-256: 9432301d91a9a85a6b96052bb42122fc19f7588ae6f4a3df9592d22b70e95fa8
hibernate3-annotations-javadoc-3.2.1-1.patch02.1jpp.ep1.3.el5.1.noarch.rpm	SHA-256: 242b906abfcd1d4b9063714fbc5e332c351b62cb73c94792b9f765075f7efdb4
hibernate3-entitymanager-3.2.1-1jpp.ep1.7.el5.noarch.rpm	SHA-256: 756626d3272e5226121f044ba54ae4d5fda8adde170d94efbb5ccee106e383e6
hibernate3-entitymanager-javadoc-3.2.1-1jpp.ep1.7.el5.noarch.rpm	SHA-256: 6979c35e8f81b573b4cf9e2b77f25e51409ccf789bd238e02429d42947cdc1bd
hibernate3-javadoc-3.2.4-1.SP1_CP03.0jpp.ep1.1.el5.noarch.rpm	SHA-256: 3f803729e0c916bd6ebc1158e516518798bda6a1118ce0020b89af0ebe420b84
jboss-aop-1.5.5-1.CP01.0jpp.ep1.1.el5.noarch.rpm	SHA-256: 27c3ee003435da7091eb14f0b6d8ee17510ae0ac50718a6ae2ba5a2b47cb42f6
jboss-cache-1.4.1-4.SP9.1jpp.ep1.1.el5.noarch.rpm	SHA-256: 8a42ddd3939bd672380b70bb65bb6223f4e4193c46ad1cb1a459f19e9cad4440
jboss-messaging-1.4.0-1.SP3_CP02.0jpp.ep1.6.el5.noarch.rpm	SHA-256: 2f4c9577e88a28ceeb0b20000789602a06363ed17a57f5ce0a38752d769cca6c
jboss-remoting-2.2.2-3.SP7.0jpp.ep1.3.el5.noarch.rpm	SHA-256: 637a8cb361918f31e387a300464868283f12153f5d77adb816cce997747fb3be
jboss-seam-1.2.1-3.JBPAPP_4_3_0_GA.ep1.5.el5.1.noarch.rpm	SHA-256: 57f7ebbd200e699545720fcaebb746dfa2e8480cdd7aa3e464cb3366c90782f1
jboss-seam-docs-1.2.1-3.JBPAPP_4_3_0_GA.ep1.5.el5.1.noarch.rpm	SHA-256: 0ed1212dd2cc65c86d426bede6fbef6ec6d506a6a5129b64f163a155a4714f22
jbossas-4.3.0-2.GA_CP01.ep1.6.el5.1.noarch.rpm	SHA-256: 70bd543ff8f2f97bc4c707d4abd28cf7c21bec1633dc12b6ad884737956c9792
jbossts-4.2.3-1.SP5_CP01.1jpp.ep1.1.el5.noarch.rpm	SHA-256: 402b169926e30b0f2fa43185a754246121208fe3c08587ac10a00ae074150e14
jbossws-2.0.1-2.SP2_CP01.0jpp.ep1.2.el5.noarch.rpm	SHA-256: 80625009aec04c1121a6a336680165b88e894aeb6925ad72424f9f5a38ce1de3
jbossws-native42-2.0.1-2.SP2_CP01.0jpp.ep1.2.el5.noarch.rpm	SHA-256: 712397003ad43336293d885510d28b29cb84d0d7619822e10aa6289e1009129b
jbossxb-1.0.0-2.SP1.0jpp.ep1.2.el5.1.noarch.rpm	SHA-256: 1f8cf9d0c9ec60176a6dd37fc757f901157e36cab5734f94197989f075576c60
jcommon-1.0.12-1jpp.ep1.3.el5.noarch.rpm	SHA-256: eba5133c2df9224ad4ef51eb0988d2854191a872d9a26112c5d125695ccea01c
jfreechart-1.0.9-1jpp.ep1.3.el5.1.noarch.rpm	SHA-256: 876b1a2f384254444470970aca9b212895262f0e494c67ef4ccc9bdb228a2edd
jgroups-2.4.2-1.GA_CP01.0jpp.ep1.1.el5.noarch.rpm	SHA-256: 31af3233865b1660d2ed6b8e411fd59c3652130859064a6b4cee30f64d55d17c
rh-eap-docs-4.3.0-2.GA_CP01.ep1.4.el5.noarch.rpm	SHA-256: aa456a500dbaea6c4f90cde63874c73885300f8c960537d14e46211a8c1bdd6a
i386
asm-1.5.3-1jpp.ep1.2.el5.noarch.rpm	SHA-256: 2c1d5b3eb0f4eb6b58788c6fd050b05090c5f3bdec5b59e449dcbe5687d8be3c
cglib-2.1.3-2jpp.ep1.6.el5.noarch.rpm	SHA-256: 9c7494ee8e8789cd995755da4baafb4963af439705127b4833629acf45665f63
concurrent-1.3.4-8jpp.ep1.6.el5.1.noarch.rpm	SHA-256: 8eff549f24f6aa3c00c7cc42d5f94b46d3eb8747d1f97fa25f5e090b3490e16e
glassfish-jaf-1.1.0-0jpp.ep1.11.el5.1.noarch.rpm	SHA-256: d0208e5600ccde6f935151c460e440b1e85079c98cc9881f3a3427e2c205e44d
glassfish-javamail-1.4.0-0jpp.ep1.9.el5.noarch.rpm	SHA-256: 4526a1f283f92c9270685e4c68cf3e4825f5451f1014660dfefe612062cd552b
glassfish-jsf-1.2_08-0jpp.ep1.2.el5.noarch.rpm	SHA-256: c0080aa73826e1338a6a4d9de7191223619d9730c2350c45cdd3cbb28358bf93
hibernate3-annotations-3.2.1-1.patch02.1jpp.ep1.3.el5.1.noarch.rpm	SHA-256: 9432301d91a9a85a6b96052bb42122fc19f7588ae6f4a3df9592d22b70e95fa8
hibernate3-annotations-javadoc-3.2.1-1.patch02.1jpp.ep1.3.el5.1.noarch.rpm	SHA-256: 242b906abfcd1d4b9063714fbc5e332c351b62cb73c94792b9f765075f7efdb4
hibernate3-entitymanager-3.2.1-1jpp.ep1.7.el5.noarch.rpm	SHA-256: 756626d3272e5226121f044ba54ae4d5fda8adde170d94efbb5ccee106e383e6
hibernate3-entitymanager-javadoc-3.2.1-1jpp.ep1.7.el5.noarch.rpm	SHA-256: 6979c35e8f81b573b4cf9e2b77f25e51409ccf789bd238e02429d42947cdc1bd
hibernate3-javadoc-3.2.4-1.SP1_CP03.0jpp.ep1.1.el5.noarch.rpm	SHA-256: 3f803729e0c916bd6ebc1158e516518798bda6a1118ce0020b89af0ebe420b84
jboss-aop-1.5.5-1.CP01.0jpp.ep1.1.el5.noarch.rpm	SHA-256: 27c3ee003435da7091eb14f0b6d8ee17510ae0ac50718a6ae2ba5a2b47cb42f6
jboss-cache-1.4.1-4.SP9.1jpp.ep1.1.el5.noarch.rpm	SHA-256: 8a42ddd3939bd672380b70bb65bb6223f4e4193c46ad1cb1a459f19e9cad4440
jboss-messaging-1.4.0-1.SP3_CP02.0jpp.ep1.6.el5.noarch.rpm	SHA-256: 2f4c9577e88a28ceeb0b20000789602a06363ed17a57f5ce0a38752d769cca6c
jboss-remoting-2.2.2-3.SP7.0jpp.ep1.3.el5.noarch.rpm	SHA-256: 637a8cb361918f31e387a300464868283f12153f5d77adb816cce997747fb3be
jboss-seam-1.2.1-3.JBPAPP_4_3_0_GA.ep1.5.el5.1.noarch.rpm	SHA-256: 57f7ebbd200e699545720fcaebb746dfa2e8480cdd7aa3e464cb3366c90782f1
jboss-seam-docs-1.2.1-3.JBPAPP_4_3_0_GA.ep1.5.el5.1.noarch.rpm	SHA-256: 0ed1212dd2cc65c86d426bede6fbef6ec6d506a6a5129b64f163a155a4714f22
jbossas-4.3.0-2.GA_CP01.ep1.6.el5.1.noarch.rpm	SHA-256: 70bd543ff8f2f97bc4c707d4abd28cf7c21bec1633dc12b6ad884737956c9792
jbossts-4.2.3-1.SP5_CP01.1jpp.ep1.1.el5.noarch.rpm	SHA-256: 402b169926e30b0f2fa43185a754246121208fe3c08587ac10a00ae074150e14
jbossws-2.0.1-2.SP2_CP01.0jpp.ep1.2.el5.noarch.rpm	SHA-256: 80625009aec04c1121a6a336680165b88e894aeb6925ad72424f9f5a38ce1de3
jbossws-native42-2.0.1-2.SP2_CP01.0jpp.ep1.2.el5.noarch.rpm	SHA-256: 712397003ad43336293d885510d28b29cb84d0d7619822e10aa6289e1009129b
jbossxb-1.0.0-2.SP1.0jpp.ep1.2.el5.1.noarch.rpm	SHA-256: 1f8cf9d0c9ec60176a6dd37fc757f901157e36cab5734f94197989f075576c60
jcommon-1.0.12-1jpp.ep1.3.el5.noarch.rpm	SHA-256: eba5133c2df9224ad4ef51eb0988d2854191a872d9a26112c5d125695ccea01c
jfreechart-1.0.9-1jpp.ep1.3.el5.1.noarch.rpm	SHA-256: 876b1a2f384254444470970aca9b212895262f0e494c67ef4ccc9bdb228a2edd
jgroups-2.4.2-1.GA_CP01.0jpp.ep1.1.el5.noarch.rpm	SHA-256: 31af3233865b1660d2ed6b8e411fd59c3652130859064a6b4cee30f64d55d17c
rh-eap-docs-4.3.0-2.GA_CP01.ep1.4.el5.noarch.rpm	SHA-256: aa456a500dbaea6c4f90cde63874c73885300f8c960537d14e46211a8c1bdd6a