Synopsis

Low: JBoss Enterprise Application Platform 4.3.0CP02 security update

Type/Severity

Security Advisory: Low

Topic

Updated JBoss Enterprise Application Platform (JBEAP) 4.3 packages that fix
various security issues are now available for Red Hat Enterprise Linux 5 as
JBEAP 4.3.0.CP02.

This update has been rated as having low security impact by the Red Hat
Security Response Team.

Description

JBoss Enterprise Application Platform is the market leading platform for
innovative and scalable Java applications; integrating the JBoss
Application Server, with JBoss Hibernate and JBoss Seam into a complete,
simple enterprise solution.

This release of JBEAP for Red Hat Enterprise Linux 5 serves as a
replacement to JBEAP 4.3.0.CP01.

These updated packages include bug fixes and enhancements which are
detailed in the release notes. The link to the release notes is available
below in the References section.

The following security issues are also fixed with this release:

The default security policy in the JULI logging component did not restrict
access permissions to files. This could be misused by untrusted web
applications to access and write arbitrary files in the context of the
tomcat process. (CVE-2007-5342)

The property that controls the download of server classes was set to "true"
in the "production" configuration. When the class download service is bound
to an external interface, a remote attacker was able to download arbitrary
class files from the server class path. (CVE-2008-3519)

Warning: before applying this update, please backup the JBEAP
"server/[configuration]/deploy/" directory, and any other customized
configuration files.

All users of JBEAP 4.3 on Red Hat Enterprise Linux 5 are advised to upgrade
to these updated packages, which resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• JBoss Enterprise Application Platform 4.3.0 x86_64
• JBoss Enterprise Application Platform 4.3.0 i386

Fixes

• BZ - 427216 - CVE-2007-5342 Apache Tomcat's default security policy is too open
• BZ - 458713 - Tracker bug for the EAP 4.3.0.cp02 release for RHEL-5
• BZ - 458823 - CVE-2008-3519 JBossEAP allows download of non-EJB class files

CVEs

• CVE-2007-5342
• CVE-2008-3519

References

• http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3.0.cp02/html-single/readme/index.html
• http://www.redhat.com/security/updates/classification/#low

JBoss Enterprise Application Platform 4.3.0

SRPM
glassfish-jaf-1.1.0-0jpp.ep1.12.el5.1.src.rpm	SHA-256: 8e35ae95242d016d501395878388cc1c58e1fa3533dc89be59f3d69acfc6ffdb
glassfish-javamail-1.4.0-0jpp.ep1.10.el5.src.rpm	SHA-256: bfb9886356fb79c6f4f7c8fbfd5a20b5673eca74d069598c9b3174060797c7d7
glassfish-jaxb-2.1.4-1jpp.ep1.4.el5.2.src.rpm	SHA-256: af86865aca12ca2a6a2bfaaab7785f46515bc0aa4b2f0eae05688c8015f90857
glassfish-jaxws-2.1.1-1jpp.ep1.3.el5.src.rpm	SHA-256: 77da6c016f146f186bfad121447c2eefe1b8776080ff50a26b2e91b467a56a6d
glassfish-jstl-1.2.0-0jpp.ep1.10.el5.src.rpm	SHA-256: 7ed2f9d9b3db41393c64af844036dab37a1a71852175e9a570ee98dc7e07666d
hibernate3-3.2.4-1.SP1_CP04.0jpp.ep1.3.el5.src.rpm	SHA-256: 281f38441edd43c85663302e4d735d1357ce4568550b8e2ad171a7bb148fb530
hibernate3-annotations-3.2.1-4.GA_CP02.1jpp.ep1.7.el5.1.src.rpm	SHA-256: 613dfd109b18b6eda91350fc3705bf731401924f77f9386927ea7b189706c2d9
hibernate3-commons-annotations-0.0.0-1.1jpp.ep1.1.el5.src.rpm	SHA-256: 9b8e8974e26bdd9f950d83fd2dab1cfb604af96ae2ce204e360bf4a84ba37c33
hibernate3-entitymanager-3.2.1-2.GA_CP03.1jpp.ep1.9.el5.src.rpm	SHA-256: 110013700edd69ad69a8400e95e386f06c3fe5048d00fafea31c88877790b090
hibernate3-validator-0.0.0-1.1jpp.ep1.1.el5.src.rpm	SHA-256: 43019d6f256a5da4f1697e26d0aed7352b58198cef0bf1156a9ac34a06c57939
javassist-3.8.0-1jpp.ep1.2.el5.src.rpm	SHA-256: 8c18453901e4510963f9f9f6d16a5dcc1ca644ecc19e899469062574c1bd19fe
jboss-aop-1.5.5-2.CP02.0jpp.ep1.2.el5.src.rpm	SHA-256: dd654974dc04ef9d13e515ddf55fa4a72d3e5a2f61d16e94a1eb6857faf2f522
jboss-jaxr-1.2.0-SP1.0jpp.ep1.4.el5.src.rpm	SHA-256: 1fd6f4c8124ba493b3ed5255f3cafeef78ac695789756c33ce6cb2a4c3dbefd5
jboss-messaging-1.4.0-1.SP3_CP03.0jpp.ep1.3.el5.src.rpm	SHA-256: ba4447bc0d71fc8408c4e555ba1f2fc479bb31364c7b4e6ee1123eb00aa1b07a
jboss-remoting-2.2.2-3.SP9.0jpp.ep1.2.el5.src.rpm	SHA-256: cf673d4dfef5f375ede30ff9faef4a00698d65e897cfc582ffe23b8dee0a483d
jboss-seam-1.2.1-3.JBPAPP_4_3_0_GA.ep1.7.el5.1.src.rpm	SHA-256: 1194d1ecefc1756bbe182c82d7a367587da5f825960eb8cf6e18d7951af9b120
jbossas-4.3.0-2.GA_CP02.ep1.10.el5.2.src.rpm	SHA-256: a8f9d79580e3048f585007325aed61e0b48332077c2faab0965d67e87539518f
jbossts-4.2.3-1.SP5_CP02.1jpp.ep1.2.el5.src.rpm	SHA-256: f9e076fb4a2736bb05d6c3510dcf82a807de01149bd59757171eebd41c35b8fe
jbossweb-2.0.0-4.CP06.0jpp.ep1.1.el5.src.rpm	SHA-256: d22c9999213c724fa079cdc8d5194f368fbab978a72c92ee174b1a027a71eafd
jbossws-2.0.1-2.SP2_CP03.0jpp.ep1.1.el5.1.src.rpm	SHA-256: 5e5b9ea643d3c6ca9505426f4500040db160bb11639413247de5b12057f47c53
jbossws-common-1.0.0-1.GA_CP01.0jpp.ep1.3.el5.src.rpm	SHA-256: 522ae1aecd35e6ee949a6a27752a23f625ab3a3246dbab559f043584ecadf759
jbossws-framework-2.0.1-0jpp.ep1.11.el5.src.rpm	SHA-256: 591efead94482a5e42062e697788a0f60fc0be427c82f55d78edaf74382902a9
jbossxb-1.0.0-2.SP3.0jpp.ep1.3.el5.1.src.rpm	SHA-256: bb12cd7996e368bd1bbafb3fa8579340656c976eb5171cc711cae80dc16b44c1
rh-eap-docs-4.3.0-2.GA_CP02.ep1.6.el5.src.rpm	SHA-256: 7c5a896491fa7c6c75a4ec6672337b3163815a5d270c582f6886885c79be13dd
x86_64
glassfish-jaf-1.1.0-0jpp.ep1.12.el5.1.noarch.rpm	SHA-256: 2d8cedf66cc418cd7b99499af8c757107f3e6c906ba7dbaf439bd35451000a33
glassfish-javamail-1.4.0-0jpp.ep1.10.el5.noarch.rpm	SHA-256: f787924007661eb7a0591f9cde3546d428b74269262191a37c5a4e2c320aca5e
glassfish-jaxb-2.1.4-1jpp.ep1.4.el5.2.noarch.rpm	SHA-256: 02a30e85a50fa7d86bdbc3e6d88f2c42cd6b427f1d22b17e5578e63330a223d5
glassfish-jaxb-javadoc-2.1.4-1jpp.ep1.4.el5.2.noarch.rpm	SHA-256: ed5c4e6a2f6d7700512a934c954242e45077a5e80238a3dcf192d968445419df
glassfish-jaxws-2.1.1-1jpp.ep1.3.el5.noarch.rpm	SHA-256: 456e0816ca8f686139d344fdaff9edc4dcc6bbde33c17efc91abc2c1853a2925
glassfish-jaxws-javadoc-2.1.1-1jpp.ep1.3.el5.noarch.rpm	SHA-256: 8d3280478a94bd475bc5d4f259d4285ddc7b23e710054cbe0557e7fe44313f1a
glassfish-jstl-1.2.0-0jpp.ep1.10.el5.noarch.rpm	SHA-256: 23eb9a62c561a3373f1408786492471acca5ea85beb714437abc1c3e5a7e824b
hibernate3-3.2.4-1.SP1_CP04.0jpp.ep1.3.el5.noarch.rpm	SHA-256: 99835a29d3b4aee6668efd3dd635518aa6b757c6efef12427abd9c0f01ce1a2b
hibernate3-annotations-3.2.1-4.GA_CP02.1jpp.ep1.7.el5.1.noarch.rpm	SHA-256: ded1a558c41ac7893b6cd8f8018232334d7e9329760a8ef5438c39ad497cc217
hibernate3-annotations-javadoc-3.2.1-4.GA_CP02.1jpp.ep1.7.el5.1.noarch.rpm	SHA-256: e40793cf64bab92b50d23bf2833f146c53dfffd4d344b236ed4fd3f52ff1894f
hibernate3-commons-annotations-0.0.0-1.1jpp.ep1.1.el5.noarch.rpm	SHA-256: ccc8e7f707cb5d58ad3716b94b445d6541aa71b56e18a89b0405463a49a329fb
hibernate3-entitymanager-3.2.1-2.GA_CP03.1jpp.ep1.9.el5.noarch.rpm	SHA-256: ddd54c9761e1ad19ea8d2e2ebe9cd308fe567edea519d8e273b333984f8cd165
hibernate3-entitymanager-javadoc-3.2.1-2.GA_CP03.1jpp.ep1.9.el5.noarch.rpm	SHA-256: 5409e503e6e683dd2c5d6556ee7c7398345c1e2c7e8a25c8caeafc6b400588b2
hibernate3-javadoc-3.2.4-1.SP1_CP04.0jpp.ep1.3.el5.noarch.rpm	SHA-256: d6b906a3d609410282e9d1c22926500988ad847a91daf572c499a3cdf9f4ecf1
hibernate3-validator-0.0.0-1.1jpp.ep1.1.el5.noarch.rpm	SHA-256: 5aeb70cfd35e777e47c5e97b8df9d65aa6981642a82048bfc5733aacb7df50d2
javassist-3.8.0-1jpp.ep1.2.el5.noarch.rpm	SHA-256: 93574131a73c5572c3503fbff526fa884ae2cf467d94ad8ca988b445259c7092
jboss-aop-1.5.5-2.CP02.0jpp.ep1.2.el5.noarch.rpm	SHA-256: e98ed9a05e88d1dd6f7f676c5e757dbc559061f26156755c37c1dce8f1e50d5d
jboss-jaxr-1.2.0-SP1.0jpp.ep1.4.el5.noarch.rpm	SHA-256: 3981f34faa06638e9e420ce7a3f73065479f7bed5d2f1a15c1569653c571821f
jboss-messaging-1.4.0-1.SP3_CP03.0jpp.ep1.3.el5.noarch.rpm	SHA-256: 57f5f112ec78c99cdfd15bfa370eb2a8e421093d2399b47695ad8db7fdbfd5ba
jboss-remoting-2.2.2-3.SP9.0jpp.ep1.2.el5.noarch.rpm	SHA-256: 8bd83cc0cd95adffe0891af259a95182f61ac07caa6ad4e816c5dfe57aa895c3
jboss-seam-1.2.1-3.JBPAPP_4_3_0_GA.ep1.7.el5.1.noarch.rpm	SHA-256: 909715fc8eb16dd99bb8338b88e271cf9d31194b1171d5b76384adb2174b3cb4
jboss-seam-docs-1.2.1-3.JBPAPP_4_3_0_GA.ep1.7.el5.1.noarch.rpm	SHA-256: 5db86594cf6d088922e3d9a48ca0aea57f31994e4d50767c91a2a277a2bbca0e
jbossas-4.3.0-2.GA_CP02.ep1.10.el5.2.noarch.rpm	SHA-256: 44a3eeb6db393cde70f5c0f5f9dc80643c5fbdedb34992fa744ecce431493d51
jbossts-4.2.3-1.SP5_CP02.1jpp.ep1.2.el5.noarch.rpm	SHA-256: 76d62d44ed9f61849d99c0e19ee490de720c1994ba2a0e2ec5412ee8a2a1f53f
jbossweb-2.0.0-4.CP06.0jpp.ep1.1.el5.noarch.rpm	SHA-256: 0a8af2c3e511f386b17652040d5334fe3444ecbc58cd54b3143732d56c8138a9
jbossws-2.0.1-2.SP2_CP03.0jpp.ep1.1.el5.1.noarch.rpm	SHA-256: 1f94b5dda131a098a819c6d3c57047fd4d4c5c07086c1839f706f3fa7e79f3e6
jbossws-common-1.0.0-1.GA_CP01.0jpp.ep1.3.el5.noarch.rpm	SHA-256: 96715edda1611dfdae65820de835d63b94c88a373d4edf57805cfa3f75005a4c
jbossws-framework-2.0.1-0jpp.ep1.11.el5.noarch.rpm	SHA-256: bce343234c884d4e20c8920ffefe9629b3e19cb82b1ea4ea6e8745e65c16bc89
jbossxb-1.0.0-2.SP3.0jpp.ep1.3.el5.1.noarch.rpm	SHA-256: 3670d1a9fdb02084b465a854d3efa4d8102b9ec50d7384841e216ced2b9ec3a2
rh-eap-docs-4.3.0-2.GA_CP02.ep1.6.el5.noarch.rpm	SHA-256: 3d6e0e64bc6eab4392a781c39c10e33d7aae4c48f5a5cef31459140122efa5f7
i386
glassfish-jaf-1.1.0-0jpp.ep1.12.el5.1.noarch.rpm	SHA-256: 2d8cedf66cc418cd7b99499af8c757107f3e6c906ba7dbaf439bd35451000a33
glassfish-javamail-1.4.0-0jpp.ep1.10.el5.noarch.rpm	SHA-256: f787924007661eb7a0591f9cde3546d428b74269262191a37c5a4e2c320aca5e
glassfish-jaxb-2.1.4-1jpp.ep1.4.el5.2.noarch.rpm	SHA-256: 02a30e85a50fa7d86bdbc3e6d88f2c42cd6b427f1d22b17e5578e63330a223d5
glassfish-jaxb-javadoc-2.1.4-1jpp.ep1.4.el5.2.noarch.rpm	SHA-256: ed5c4e6a2f6d7700512a934c954242e45077a5e80238a3dcf192d968445419df
glassfish-jaxws-2.1.1-1jpp.ep1.3.el5.noarch.rpm	SHA-256: 456e0816ca8f686139d344fdaff9edc4dcc6bbde33c17efc91abc2c1853a2925
glassfish-jaxws-javadoc-2.1.1-1jpp.ep1.3.el5.noarch.rpm	SHA-256: 8d3280478a94bd475bc5d4f259d4285ddc7b23e710054cbe0557e7fe44313f1a
glassfish-jstl-1.2.0-0jpp.ep1.10.el5.noarch.rpm	SHA-256: 23eb9a62c561a3373f1408786492471acca5ea85beb714437abc1c3e5a7e824b
hibernate3-3.2.4-1.SP1_CP04.0jpp.ep1.3.el5.noarch.rpm	SHA-256: 99835a29d3b4aee6668efd3dd635518aa6b757c6efef12427abd9c0f01ce1a2b
hibernate3-annotations-3.2.1-4.GA_CP02.1jpp.ep1.7.el5.1.noarch.rpm	SHA-256: ded1a558c41ac7893b6cd8f8018232334d7e9329760a8ef5438c39ad497cc217
hibernate3-annotations-javadoc-3.2.1-4.GA_CP02.1jpp.ep1.7.el5.1.noarch.rpm	SHA-256: e40793cf64bab92b50d23bf2833f146c53dfffd4d344b236ed4fd3f52ff1894f
hibernate3-commons-annotations-0.0.0-1.1jpp.ep1.1.el5.noarch.rpm	SHA-256: ccc8e7f707cb5d58ad3716b94b445d6541aa71b56e18a89b0405463a49a329fb
hibernate3-entitymanager-3.2.1-2.GA_CP03.1jpp.ep1.9.el5.noarch.rpm	SHA-256: ddd54c9761e1ad19ea8d2e2ebe9cd308fe567edea519d8e273b333984f8cd165
hibernate3-entitymanager-javadoc-3.2.1-2.GA_CP03.1jpp.ep1.9.el5.noarch.rpm	SHA-256: 5409e503e6e683dd2c5d6556ee7c7398345c1e2c7e8a25c8caeafc6b400588b2
hibernate3-javadoc-3.2.4-1.SP1_CP04.0jpp.ep1.3.el5.noarch.rpm	SHA-256: d6b906a3d609410282e9d1c22926500988ad847a91daf572c499a3cdf9f4ecf1
hibernate3-validator-0.0.0-1.1jpp.ep1.1.el5.noarch.rpm	SHA-256: 5aeb70cfd35e777e47c5e97b8df9d65aa6981642a82048bfc5733aacb7df50d2
javassist-3.8.0-1jpp.ep1.2.el5.noarch.rpm	SHA-256: 93574131a73c5572c3503fbff526fa884ae2cf467d94ad8ca988b445259c7092
jboss-aop-1.5.5-2.CP02.0jpp.ep1.2.el5.noarch.rpm	SHA-256: e98ed9a05e88d1dd6f7f676c5e757dbc559061f26156755c37c1dce8f1e50d5d
jboss-jaxr-1.2.0-SP1.0jpp.ep1.4.el5.noarch.rpm	SHA-256: 3981f34faa06638e9e420ce7a3f73065479f7bed5d2f1a15c1569653c571821f
jboss-messaging-1.4.0-1.SP3_CP03.0jpp.ep1.3.el5.noarch.rpm	SHA-256: 57f5f112ec78c99cdfd15bfa370eb2a8e421093d2399b47695ad8db7fdbfd5ba
jboss-remoting-2.2.2-3.SP9.0jpp.ep1.2.el5.noarch.rpm	SHA-256: 8bd83cc0cd95adffe0891af259a95182f61ac07caa6ad4e816c5dfe57aa895c3
jboss-seam-1.2.1-3.JBPAPP_4_3_0_GA.ep1.7.el5.1.noarch.rpm	SHA-256: 909715fc8eb16dd99bb8338b88e271cf9d31194b1171d5b76384adb2174b3cb4
jboss-seam-docs-1.2.1-3.JBPAPP_4_3_0_GA.ep1.7.el5.1.noarch.rpm	SHA-256: 5db86594cf6d088922e3d9a48ca0aea57f31994e4d50767c91a2a277a2bbca0e
jbossas-4.3.0-2.GA_CP02.ep1.10.el5.2.noarch.rpm	SHA-256: 44a3eeb6db393cde70f5c0f5f9dc80643c5fbdedb34992fa744ecce431493d51
jbossts-4.2.3-1.SP5_CP02.1jpp.ep1.2.el5.noarch.rpm	SHA-256: 76d62d44ed9f61849d99c0e19ee490de720c1994ba2a0e2ec5412ee8a2a1f53f
jbossweb-2.0.0-4.CP06.0jpp.ep1.1.el5.noarch.rpm	SHA-256: 0a8af2c3e511f386b17652040d5334fe3444ecbc58cd54b3143732d56c8138a9
jbossws-2.0.1-2.SP2_CP03.0jpp.ep1.1.el5.1.noarch.rpm	SHA-256: 1f94b5dda131a098a819c6d3c57047fd4d4c5c07086c1839f706f3fa7e79f3e6
jbossws-common-1.0.0-1.GA_CP01.0jpp.ep1.3.el5.noarch.rpm	SHA-256: 96715edda1611dfdae65820de835d63b94c88a373d4edf57805cfa3f75005a4c
jbossws-framework-2.0.1-0jpp.ep1.11.el5.noarch.rpm	SHA-256: bce343234c884d4e20c8920ffefe9629b3e19cb82b1ea4ea6e8745e65c16bc89
jbossxb-1.0.0-2.SP3.0jpp.ep1.3.el5.1.noarch.rpm	SHA-256: 3670d1a9fdb02084b465a854d3efa4d8102b9ec50d7384841e216ced2b9ec3a2
rh-eap-docs-4.3.0-2.GA_CP02.ep1.6.el5.noarch.rpm	SHA-256: 3d6e0e64bc6eab4392a781c39c10e33d7aae4c48f5a5cef31459140122efa5f7