Synopsis

Moderate: mod_cluster security update

Type/Severity

Security Advisory: Moderate

Topic

Updated mod_cluster packages that fix one security issue are now available
for JBoss Enterprise Web Server 1.0.2 for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

mod_cluster is an Apache HTTP Server (httpd) based load balancer that
forwards requests from httpd to application server nodes. It can use the
AJP, HTTP, or HTTPS protocols for communication with application server
nodes.

The RHSA-2012:0035 update for JBoss Enterprise Web Server 1.0.2 introduced
a regression, causing mod_cluster to register and expose the root context
of a server by default, even when "ROOT" was in the "excludedContexts" list
in the mod_cluster configuration. If an application was deployed on the
root context, a remote attacker could use this flaw to bypass intended
access restrictions and gain access to that application. (CVE-2012-1154)

Warning: Before applying the update, back up your existing JBoss Enterprise
Web Server installation (including all applications and configuration
files).

Users of JBoss Enterprise Web Server 1.0.2 on Red Hat Enterprise Linux 5
and 6 should upgrade to these updated packages, which resolve this issue.
Apache Tomcat must be restarted for this update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• JBoss Enterprise Web Server 1 for RHEL 6 x86_64
• JBoss Enterprise Web Server 1 for RHEL 6 i386
• JBoss Enterprise Web Server 1 for RHEL 5 x86_64
• JBoss Enterprise Web Server 1 for RHEL 5 i386

Fixes

• BZ - 802200 - CVE-2012-1154 mod_cluster registers and exposes the root context of a server by default, despite ROOT being in the excluded-contexts list

CVEs

• CVE-2012-1154

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://rhn.redhat.com/errata/RHSA-2012-0035.html

JBoss Enterprise Web Server 1 for RHEL 6

SRPM
mod_cluster-1.0.10-4.1.GA_CP02_patch01.ep5.el6.src.rpm	SHA-256: 6c1ac971516de4710e1574d4d66c00861126a6663df57f735328da801fb77ac8
x86_64
mod_cluster-demo-1.0.10-4.1.GA_CP02_patch01.ep5.el6.noarch.rpm	SHA-256: fe14e972b0c7be23a5bcb6e690e6e47c5f552463b6786e3dbfa44a4cd12544f0
mod_cluster-jbossas-1.0.10-4.1.GA_CP02_patch01.ep5.el6.noarch.rpm	SHA-256: e891e9b20d7eee5a24328c451e2fb7857851f8e006a811e8ed580e1c9ec15a4e
mod_cluster-jbossweb2-1.0.10-4.1.GA_CP02_patch01.ep5.el6.noarch.rpm	SHA-256: 7000fe8b0bae8a053195db4c8975bb8836ef9f754053c1e39a6a86ee86dd3fcc
mod_cluster-tomcat6-1.0.10-4.1.GA_CP02_patch01.ep5.el6.noarch.rpm	SHA-256: 1c7d305ac79b5597ad61197f32a7c7d97f8725a76d8f747ebda3728b49eff79d
i386
mod_cluster-demo-1.0.10-4.1.GA_CP02_patch01.ep5.el6.noarch.rpm	SHA-256: fe14e972b0c7be23a5bcb6e690e6e47c5f552463b6786e3dbfa44a4cd12544f0
mod_cluster-jbossas-1.0.10-4.1.GA_CP02_patch01.ep5.el6.noarch.rpm	SHA-256: e891e9b20d7eee5a24328c451e2fb7857851f8e006a811e8ed580e1c9ec15a4e
mod_cluster-jbossweb2-1.0.10-4.1.GA_CP02_patch01.ep5.el6.noarch.rpm	SHA-256: 7000fe8b0bae8a053195db4c8975bb8836ef9f754053c1e39a6a86ee86dd3fcc
mod_cluster-tomcat6-1.0.10-4.1.GA_CP02_patch01.ep5.el6.noarch.rpm	SHA-256: 1c7d305ac79b5597ad61197f32a7c7d97f8725a76d8f747ebda3728b49eff79d

JBoss Enterprise Web Server 1 for RHEL 5

SRPM
mod_cluster-1.0.10-4.1.GA_CP02_patch01.ep5.el5.src.rpm	SHA-256: e8fe77d7a774488c45decb55a9a1328c605bbd06e588fbb6534904dfd88a074d
x86_64
mod_cluster-demo-1.0.10-4.1.GA_CP02_patch01.ep5.el5.noarch.rpm	SHA-256: 1fc28f3c1cbf66f7fc4019800e3b11f46bb3d0b9c5aac542e8636da0fdeecea3
mod_cluster-jbossas-1.0.10-4.1.GA_CP02_patch01.ep5.el5.noarch.rpm	SHA-256: 2923f7c7d738b1f0bea8aea62cbfbed88040032578bc49074847ee587fd5b5b0
mod_cluster-jbossweb2-1.0.10-4.1.GA_CP02_patch01.ep5.el5.noarch.rpm	SHA-256: f19a0182637582985a0d56bb5537f0e80ab35798c9c52f11ca308028b803ae69
mod_cluster-tomcat6-1.0.10-4.1.GA_CP02_patch01.ep5.el5.noarch.rpm	SHA-256: 6f137688a7ce510496a481d5cad25ab46084ab51c1cc6ced61fbded66c236c5e
i386
mod_cluster-demo-1.0.10-4.1.GA_CP02_patch01.ep5.el5.noarch.rpm	SHA-256: 1fc28f3c1cbf66f7fc4019800e3b11f46bb3d0b9c5aac542e8636da0fdeecea3
mod_cluster-jbossas-1.0.10-4.1.GA_CP02_patch01.ep5.el5.noarch.rpm	SHA-256: 2923f7c7d738b1f0bea8aea62cbfbed88040032578bc49074847ee587fd5b5b0
mod_cluster-jbossweb2-1.0.10-4.1.GA_CP02_patch01.ep5.el5.noarch.rpm	SHA-256: f19a0182637582985a0d56bb5537f0e80ab35798c9c52f11ca308028b803ae69
mod_cluster-tomcat6-1.0.10-4.1.GA_CP02_patch01.ep5.el5.noarch.rpm	SHA-256: 6f137688a7ce510496a481d5cad25ab46084ab51c1cc6ced61fbded66c236c5e