Synopsis

Important: JBoss Enterprise Application Platform 4.3.0.CP05 update

Type/Severity

Security Advisory: Important

Topic

Updated JBoss Enterprise Application Platform (JBEAP) 4.3 packages that fix
various issues are now available for Red Hat Enterprise Linux 5 as JBEAP
4.3.0.CP05.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

JBoss Enterprise Application Platform is the market leading platform for
innovative and scalable Java applications; integrating the JBoss
Application Server, with JBoss Hibernate and JBoss Seam into a complete,
simple enterprise solution.

This release of JBEAP for Red Hat Enterprise Linux 5 serves as a
replacement to JBEAP 4.3.0.CP04.

These updated packages include bug fixes and enhancements which are
detailed in the release notes. The link to the release notes is available
below in the References section of this errata.

The following security issues are also fixed with this release:

It was discovered that request dispatchers did not properly normalize user
requests that have trailing query strings, allowing remote attackers to
send specially-crafted requests that would cause an information leak.
(CVE-2008-5515)

It was discovered that the error checking methods of certain authentication
classes did not have sufficient error checking, allowing remote attackers
to enumerate (via brute force methods) usernames registered with
applications deployed on JBossWeb when FORM-based authentication was used.
(CVE-2009-0580)

It was discovered that web applications containing their own XML parsers
could replace the XML parser JBossWeb uses to parse configuration files. A
malicious web application running on a JBossWeb instance could read or,
potentially, modify the configuration and XML-based data of other web
applications deployed on the same JBossWeb instance. (CVE-2009-0783)

Warning: before applying this update, please back up the JBEAP
"server/[configuration]/deploy/" directory, and any other customized
configuration files.

All users of JBEAP 4.3 on Red Hat Enterprise Linux 5 are advised to upgrade
to these updated packages.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• JBoss Enterprise Application Platform 4.3.0 x86_64
• JBoss Enterprise Application Platform 4.3.0 i386

Fixes

• BZ - 499602 - Tracker bug for the EAP 4.3.0.cp05 release for RHEL-5.
• BZ - 503978 - CVE-2009-0580 tomcat6 Information disclosure in authentication classes
• BZ - 504153 - CVE-2009-0783 tomcat XML parser information disclosure
• BZ - 504753 - CVE-2008-5515 tomcat request dispatcher information disclosure vulnerability

CVEs

• CVE-2008-5515
• CVE-2009-0783
• CVE-2009-0580

References

• http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3.0.cp05/html-single/Release_Notes/index.html
• http://www.redhat.com/security/updates/classification/#important

JBoss Enterprise Application Platform 4.3.0

SRPM
glassfish-jaxb-2.1.4-1.11.1.ep1.el5.src.rpm	SHA-256: f13a148b8badde25c53a3ba1fb97fa441adc81488a6a7445f9534a3aef6d31f5
hibernate3-3.2.4-1.SP1_CP08.0jpp.ep1.2.3.el5.src.rpm	SHA-256: f7aa609a728dc79b250eb9108103466325cd95bcc808152f7da1ffde659c0545
hibernate3-annotations-3.3.1-1.10.1GA_CP01.ep1.el5.src.rpm	SHA-256: 31aa4b790c7930ab8a16fa08bcd0592c0ba2156e8b9cff17ef862fb6b32fdae2
hibernate3-commons-annotations-3.0.0-1jpp.ep1.5.2.el5.src.rpm	SHA-256: e3e461b72a0604cc4f5ccd41bcb5337dfc059b8bd7bd517c20d771ab04f5c50a
hibernate3-entitymanager-3.3.2-2.4.1.ep1.el5.src.rpm	SHA-256: e908bc2a894411e723946664782c0e380d0330cbd3af1d46752c5aa51e2e65dd
hibernate3-validator-3.0.0-1jpp.ep1.8.3.el5.src.rpm	SHA-256: b74842f71d8aab29a1b228f958c1cbb45d000195868e7c9d392dbd2a26204e38
jakarta-slide-webdavclient-2.1-9.2.el5.src.rpm	SHA-256: 174f207a4f3addafbec8f7268f9fc90303674f708d1111a3ed9242df00e92bdb
jboss-cache-1.4.1-6.SP13.1.ep1.el5.src.rpm	SHA-256: f6e7fca29e5106b23a75f2082795e79fb39ca83ac0894ed41b292da94530c8da
jboss-messaging-1.4.0-2.SP3_CP08.1.ep1.el5.src.rpm	SHA-256: 358fba8dd5269b76a1ca0ab315754aaaaf718add2080cc3e540964d0611d31d3
jboss-remoting-2.2.3-2.ep1.el5.src.rpm	SHA-256: 130bdd1ddcdd88638a715db59356e6a67450e9cf947af7397dba7acaa040a8b2
jboss-seam-1.2.1-3.JBPAPP_4_3_0_GA.ep1.11.el5.1.src.rpm	SHA-256: 747775162d78d556c91ce66fc52a9d248bb405d8c6009c416c0f9dea82c2f82a
jbossas-4.3.0-4.GA_CP05.6.1.ep1.el5.src.rpm	SHA-256: f61b2208b9790bc952ef6ae1f476cbd051d3cd35a3bc88f6a6cf613dd5a565a3
jbossts-4.2.3-1.SP5_CP05.1jpp.ep1.1.el5.src.rpm	SHA-256: 8252b41c707fe8acf04be10311af6b7ea1e702a1d00365b0c331bd14adfbc93a
jbossweb-2.0.0-6.CP11.0jpp.ep1.1.el5.src.rpm	SHA-256: 57919d356594072c72c42aea81aaaba55a1dff520a578bf0336c51522b9c1059
jbossws-2.0.1-3.SP2_CP06.3.1.ep1.el5.src.rpm	SHA-256: 0193653040d03ff04b511f4767e522611448ab04916365fd4581442bbff8f48a
jbossws-common-1.0.0-2.GA_CP04.1.ep1.el5.src.rpm	SHA-256: 678582ce2365d6309d700f83039a1d7c23048cccee139b9150ac0629c6ef1646
jbossws-framework-2.0.1-1.GA_CP04.2.ep1.el5.src.rpm	SHA-256: 84e06489a79a7af4780e485e9bfd22369c21ddbb59b5846ab0a6fdedeeecf3cd
jbossws-spi-1.0.0-1.GA_CP02.1.ep1.el5.src.rpm	SHA-256: b5ab0be658a856da40420b4142423a8abc96183a62f69af713bba09712fdace8
jgroups-2.4.6-1.ep1.el5.src.rpm	SHA-256: 014dfc02360c5f7ac96389841a0383fa2fa74d4f49376487027c4ca98add6740
rh-eap-docs-4.3.0-5.GA_CP05.ep1.2.1.el5.src.rpm	SHA-256: daf8a6c1934c9debcde456298b4b4f55c3dbb05bbcf030916572a882b6b63095
x86_64
glassfish-jaxb-2.1.4-1.11.1.ep1.el5.noarch.rpm	SHA-256: 9a5ce921fd040798fc033a5b06d9a0e03721b7e705f2c66d588620ffb7842fbe
glassfish-jaxb-javadoc-2.1.4-1.11.1.ep1.el5.noarch.rpm	SHA-256: 9a0947583022434ea1ff03b48645a8c0c79d1195a58a820cd855511dbd0be110
hibernate3-3.2.4-1.SP1_CP08.0jpp.ep1.2.3.el5.noarch.rpm	SHA-256: 2f4114711a3be937338afb2ebdd9994f63f7a04dbd4dbad2902b73845f838c1d
hibernate3-annotations-3.3.1-1.10.1GA_CP01.ep1.el5.noarch.rpm	SHA-256: bb6c5aa2a80167466f750f36b744c03ab50804d01d37403064af38c74db46444
hibernate3-annotations-javadoc-3.3.1-1.10.1GA_CP01.ep1.el5.noarch.rpm	SHA-256: a3694c6a77c45fce21c052bd0544313a2b28e24e1fe6f289fbe8d7e289992ed3
hibernate3-commons-annotations-3.0.0-1jpp.ep1.5.2.el5.noarch.rpm	SHA-256: e8f596e38e3614f5b71445174dcf2fce071fb8471da13921d6a4abe8ad49c7e2
hibernate3-commons-annotations-javadoc-3.0.0-1jpp.ep1.5.2.el5.noarch.rpm	SHA-256: 6827f31f7516f5132089ab45ac3131fd8a8239af88234259a902784baf4408c7
hibernate3-entitymanager-3.3.2-2.4.1.ep1.el5.noarch.rpm	SHA-256: b51ef05aea1063d8c5bc68348dd869e97dea262d541be1905c10c1c7c0756dcf
hibernate3-entitymanager-javadoc-3.3.2-2.4.1.ep1.el5.noarch.rpm	SHA-256: bcab9eded10e179b2454f9979541f78d9c02539b916f023aa388bd499440b541
hibernate3-javadoc-3.2.4-1.SP1_CP08.0jpp.ep1.2.3.el5.noarch.rpm	SHA-256: 5a2af990255612831fc9d85ecb7f52f8ba20f08b6b156b5ca48f19983a0f520d
hibernate3-validator-3.0.0-1jpp.ep1.8.3.el5.noarch.rpm	SHA-256: c5205311bc4dddcd77c3c3ca83f9f54b90fa1149204f7135c8b2b2464967a29f
hibernate3-validator-javadoc-3.0.0-1jpp.ep1.8.3.el5.noarch.rpm	SHA-256: 46f14bd468385e4a3474cf6f9d6067618610aaaedd4a133c61b14106483ed098
jakarta-slide-webdavclient-2.1-9.2.el5.noarch.rpm	SHA-256: 49700993d058a82a98d9e9733c502601248abead2eb9ff2f11b0f31812756dba
jboss-cache-1.4.1-6.SP13.1.ep1.el5.noarch.rpm	SHA-256: 6ba4ab97f964f170ee23d770a7d28c76b0499708006ea4c7f4c8d129fc424c21
jboss-messaging-1.4.0-2.SP3_CP08.1.ep1.el5.noarch.rpm	SHA-256: 5a1c55555101a5839fcef035a0b9a5902f3be5712fcb493c10acf2c4540592cb
jboss-remoting-2.2.3-2.ep1.el5.noarch.rpm	SHA-256: 4cb8861c2413a07afbecc0f52066b242d4e7badc4e9a8803369c3d0784791096
jboss-seam-1.2.1-3.JBPAPP_4_3_0_GA.ep1.11.el5.1.noarch.rpm	SHA-256: 0590b22c1c1116f48c808efdda55bb3f28a8aa1cc85b373207c3ca4fdad4ffe9
jboss-seam-docs-1.2.1-3.JBPAPP_4_3_0_GA.ep1.11.el5.1.noarch.rpm	SHA-256: df1ce14711a0a25c83e0d81472f90902b99e74bf82eaa9c3526963555e7164f0
jbossas-4.3.0-4.GA_CP05.6.1.ep1.el5.noarch.rpm	SHA-256: d5c565df7f1004f867cdab5c47023efbc2416c90725926ae44b291d4b479c74b
jbossas-4.3.0.GA_CP05-bin-4.3.0-4.GA_CP05.6.1.ep1.el5.noarch.rpm	SHA-256: 8cb0e7e0e248e7a28485f80166553c3779053b4b2bf643eb3906c006ca6322c9
jbossas-client-4.3.0-4.GA_CP05.6.1.ep1.el5.noarch.rpm	SHA-256: 11447bae2e7d3a09a4d1f716c9d13d0392dec46a867932ad3e91c6b7d8fb2415
jbossts-4.2.3-1.SP5_CP05.1jpp.ep1.1.el5.noarch.rpm	SHA-256: f964a9b7ddc0eeab4f0b4e673c4f017c2f39360bcbcae2733e0a16fddb0007f9
jbossweb-2.0.0-6.CP11.0jpp.ep1.1.el5.noarch.rpm	SHA-256: 3ac91b5801ccd2913928e87a85fe094818f94b458633ee6d97d30492aad5fb54
jbossws-2.0.1-3.SP2_CP06.3.1.ep1.el5.noarch.rpm	SHA-256: 609f5f3bf7daeeddf3db1ebf82d6b84fedb5532d41c76b15eead8a49388f9916
jbossws-common-1.0.0-2.GA_CP04.1.ep1.el5.noarch.rpm	SHA-256: db92c2ddaffbf7ca4ce17d4878755bf512d32f2a113a0024bd266a7b18ef5fb5
jbossws-framework-2.0.1-1.GA_CP04.2.ep1.el5.noarch.rpm	SHA-256: 642fd486afb4460ff20b6c4f65ec5fbd37bdf2c6dd0dd6c43fb5856372690881
jbossws-native42-2.0.1-3.SP2_CP06.3.1.ep1.el5.noarch.rpm	SHA-256: ab2cb4284fa53635a6ce2b58e8ee35a14f973a0e8179c770813ce9535f94dedb
jbossws-spi-1.0.0-1.GA_CP02.1.ep1.el5.noarch.rpm	SHA-256: 27f4e5e59bfceff969879f648a3e23249bae48d062e4048f72e2f4a6f8b337e9
jgroups-2.4.6-1.ep1.el5.noarch.rpm	SHA-256: ccfdd130c1def813ae2f0e0aaa5ef29cbddfc01d77646efcb398275e3ef00258
rh-eap-docs-4.3.0-5.GA_CP05.ep1.2.1.el5.noarch.rpm	SHA-256: 145b81d09833ef4fd4b1c27ad35fe24551e0be4562b15d21363bffd6ca2527fc
rh-eap-docs-examples-4.3.0-5.GA_CP05.ep1.2.1.el5.noarch.rpm	SHA-256: 6942d48304a788591c942a1942ae9e2ad1c18343f8f0a8cde5ec295fb460ac8c
i386
glassfish-jaxb-2.1.4-1.11.1.ep1.el5.noarch.rpm	SHA-256: 9a5ce921fd040798fc033a5b06d9a0e03721b7e705f2c66d588620ffb7842fbe
glassfish-jaxb-javadoc-2.1.4-1.11.1.ep1.el5.noarch.rpm	SHA-256: 9a0947583022434ea1ff03b48645a8c0c79d1195a58a820cd855511dbd0be110
hibernate3-3.2.4-1.SP1_CP08.0jpp.ep1.2.3.el5.noarch.rpm	SHA-256: 2f4114711a3be937338afb2ebdd9994f63f7a04dbd4dbad2902b73845f838c1d
hibernate3-annotations-3.3.1-1.10.1GA_CP01.ep1.el5.noarch.rpm	SHA-256: bb6c5aa2a80167466f750f36b744c03ab50804d01d37403064af38c74db46444
hibernate3-annotations-javadoc-3.3.1-1.10.1GA_CP01.ep1.el5.noarch.rpm	SHA-256: a3694c6a77c45fce21c052bd0544313a2b28e24e1fe6f289fbe8d7e289992ed3
hibernate3-commons-annotations-3.0.0-1jpp.ep1.5.2.el5.noarch.rpm	SHA-256: e8f596e38e3614f5b71445174dcf2fce071fb8471da13921d6a4abe8ad49c7e2
hibernate3-commons-annotations-javadoc-3.0.0-1jpp.ep1.5.2.el5.noarch.rpm	SHA-256: 6827f31f7516f5132089ab45ac3131fd8a8239af88234259a902784baf4408c7
hibernate3-entitymanager-3.3.2-2.4.1.ep1.el5.noarch.rpm	SHA-256: b51ef05aea1063d8c5bc68348dd869e97dea262d541be1905c10c1c7c0756dcf
hibernate3-entitymanager-javadoc-3.3.2-2.4.1.ep1.el5.noarch.rpm	SHA-256: bcab9eded10e179b2454f9979541f78d9c02539b916f023aa388bd499440b541
hibernate3-javadoc-3.2.4-1.SP1_CP08.0jpp.ep1.2.3.el5.noarch.rpm	SHA-256: 5a2af990255612831fc9d85ecb7f52f8ba20f08b6b156b5ca48f19983a0f520d
hibernate3-validator-3.0.0-1jpp.ep1.8.3.el5.noarch.rpm	SHA-256: c5205311bc4dddcd77c3c3ca83f9f54b90fa1149204f7135c8b2b2464967a29f
hibernate3-validator-javadoc-3.0.0-1jpp.ep1.8.3.el5.noarch.rpm	SHA-256: 46f14bd468385e4a3474cf6f9d6067618610aaaedd4a133c61b14106483ed098
jakarta-slide-webdavclient-2.1-9.2.el5.noarch.rpm	SHA-256: 49700993d058a82a98d9e9733c502601248abead2eb9ff2f11b0f31812756dba
jboss-cache-1.4.1-6.SP13.1.ep1.el5.noarch.rpm	SHA-256: 6ba4ab97f964f170ee23d770a7d28c76b0499708006ea4c7f4c8d129fc424c21
jboss-messaging-1.4.0-2.SP3_CP08.1.ep1.el5.noarch.rpm	SHA-256: 5a1c55555101a5839fcef035a0b9a5902f3be5712fcb493c10acf2c4540592cb
jboss-remoting-2.2.3-2.ep1.el5.noarch.rpm	SHA-256: 4cb8861c2413a07afbecc0f52066b242d4e7badc4e9a8803369c3d0784791096
jboss-seam-1.2.1-3.JBPAPP_4_3_0_GA.ep1.11.el5.1.noarch.rpm	SHA-256: 0590b22c1c1116f48c808efdda55bb3f28a8aa1cc85b373207c3ca4fdad4ffe9
jboss-seam-docs-1.2.1-3.JBPAPP_4_3_0_GA.ep1.11.el5.1.noarch.rpm	SHA-256: df1ce14711a0a25c83e0d81472f90902b99e74bf82eaa9c3526963555e7164f0
jbossas-4.3.0-4.GA_CP05.6.1.ep1.el5.noarch.rpm	SHA-256: d5c565df7f1004f867cdab5c47023efbc2416c90725926ae44b291d4b479c74b
jbossas-4.3.0.GA_CP05-bin-4.3.0-4.GA_CP05.6.1.ep1.el5.noarch.rpm	SHA-256: 8cb0e7e0e248e7a28485f80166553c3779053b4b2bf643eb3906c006ca6322c9
jbossas-client-4.3.0-4.GA_CP05.6.1.ep1.el5.noarch.rpm	SHA-256: 11447bae2e7d3a09a4d1f716c9d13d0392dec46a867932ad3e91c6b7d8fb2415
jbossts-4.2.3-1.SP5_CP05.1jpp.ep1.1.el5.noarch.rpm	SHA-256: f964a9b7ddc0eeab4f0b4e673c4f017c2f39360bcbcae2733e0a16fddb0007f9
jbossweb-2.0.0-6.CP11.0jpp.ep1.1.el5.noarch.rpm	SHA-256: 3ac91b5801ccd2913928e87a85fe094818f94b458633ee6d97d30492aad5fb54
jbossws-2.0.1-3.SP2_CP06.3.1.ep1.el5.noarch.rpm	SHA-256: 609f5f3bf7daeeddf3db1ebf82d6b84fedb5532d41c76b15eead8a49388f9916
jbossws-common-1.0.0-2.GA_CP04.1.ep1.el5.noarch.rpm	SHA-256: db92c2ddaffbf7ca4ce17d4878755bf512d32f2a113a0024bd266a7b18ef5fb5
jbossws-framework-2.0.1-1.GA_CP04.2.ep1.el5.noarch.rpm	SHA-256: 642fd486afb4460ff20b6c4f65ec5fbd37bdf2c6dd0dd6c43fb5856372690881
jbossws-native42-2.0.1-3.SP2_CP06.3.1.ep1.el5.noarch.rpm	SHA-256: ab2cb4284fa53635a6ce2b58e8ee35a14f973a0e8179c770813ce9535f94dedb
jbossws-spi-1.0.0-1.GA_CP02.1.ep1.el5.noarch.rpm	SHA-256: 27f4e5e59bfceff969879f648a3e23249bae48d062e4048f72e2f4a6f8b337e9
jgroups-2.4.6-1.ep1.el5.noarch.rpm	SHA-256: ccfdd130c1def813ae2f0e0aaa5ef29cbddfc01d77646efcb398275e3ef00258
rh-eap-docs-4.3.0-5.GA_CP05.ep1.2.1.el5.noarch.rpm	SHA-256: 145b81d09833ef4fd4b1c27ad35fe24551e0be4562b15d21363bffd6ca2527fc
rh-eap-docs-examples-4.3.0-5.GA_CP05.ep1.2.1.el5.noarch.rpm	SHA-256: 6942d48304a788591c942a1942ae9e2ad1c18343f8f0a8cde5ec295fb460ac8c