RHSA-2012:0036 - Security Advisory

Topic

An update for the mod_cluster native component for JBoss Enterprise Web
Server 1.0.2 that fixes one security issue is now available from the Red
Hat Customer Portal.

The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

Description

The mod_cluster native component provides a native build of mod_cluster for
the Apache HTTP Server (httpd). mod_cluster is an httpd-based load
balancer. Like mod_jk, it uses a communication channel to forward requests
from httpd to an application server node.

It was found that mod_cluster allowed worker nodes to register on any
virtual host (vhost), regardless of the security constraints applied to
other vhosts. In a typical environment, there will be one vhost configured
internally for worker nodes, and another configured externally for serving
content. A remote attacker could use this flaw to register an
attacker-controlled worker node via an external vhost that is not
configured to apply security constraints, then use that worker node to
serve malicious content, intercept credentials, and hijack user sessions.
(CVE-2011-4608)

This update also upgrades mod_cluster to version 1.0.10.GA_CP02.

All users of JBoss Enterprise Web Server 1.0.2 as provided from the Red
Hat Customer Portal are advised to apply this update.

Solution

The References section of this erratum contains a download link (you must
log in to download the update).

The Apache HTTP Server must be restarted for this update to take effect.

Affected Products

• JBoss Enterprise Web Server Text-Only Advisories x86_64

Fixes

• BZ - 767020 - CVE-2011-4608 mod_cluster: malicious worker nodes can register on any vhost

CVEs

• CVE-2011-4608

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver&downloadType=securityPatches&version=1.0.2