RHSA-2012:1306 - Security Advisory

Topic

An update for the OpenSSL component for JBoss Enterprise Web Server 1.0.2
for Solaris and Microsoft Windows that fixes multiple security issues is
now available from the Red Hat Customer Portal.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

Description

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols, as well as a
full-strength, general purpose cryptography library.

Multiple numeric conversion errors, leading to a buffer overflow, were
found in the way OpenSSL parsed ASN.1 (Abstract Syntax Notation One) data
from BIO (OpenSSL's I/O abstraction) inputs. Specially-crafted DER
(Distinguished Encoding Rules) encoded data read from a file or other BIO
input could cause an application using the OpenSSL library to crash or,
potentially, execute arbitrary code. (CVE-2012-2110)

A double free flaw was discovered in the policy checking code in OpenSSL.
A remote attacker could use this flaw to crash an application that uses
OpenSSL by providing an X.509 certificate that has specially-crafted
policy extension data. (CVE-2011-4109)

An information leak flaw was found in the SSL 3.0 protocol implementation
in OpenSSL. Incorrect initialization of SSL record padding bytes could
cause an SSL client or server to send a limited amount of possibly
sensitive data to its SSL peer via the encrypted connection.
(CVE-2011-4576)

It was discovered that OpenSSL did not limit the number of TLS/SSL
handshake restarts required to support Server Gated Cryptography. A remote
attacker could use this flaw to make a TLS/SSL server using OpenSSL consume
an excessive amount of CPU by continuously restarting the handshake.
(CVE-2011-4619)

This update also fixes additional security issues in OpenSSL that are not
exposed in JBoss Enterprise Web Server: CVE-2011-4108, CVE-2012-0884,
CVE-2012-1165, and CVE-2012-2333.

Warning: Before applying the update, back up your existing JBoss Enterprise
Web Server installation (including all applications and configuration
files).

All users of JBoss Enterprise Web Server 1.0.2 for Solaris and Microsoft
Windows as provided from the Red Hat Customer Portal are advised to apply
this update.

Solution

The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing JBoss Enterprise Web Server installation (including all
applications and configuration files).

The Apache HTTP Server must be restarted for this update to take effect.

Affected Products

• JBoss Enterprise Web Server Text-Only Advisories x86_64

Fixes

• BZ - 771770 - CVE-2011-4108 openssl: DTLS plaintext recovery attack
• BZ - 771771 - CVE-2011-4109 openssl: double-free in policy checks
• BZ - 771775 - CVE-2011-4576 openssl: uninitialized SSL 3.0 padding
• BZ - 771780 - CVE-2011-4619 openssl: SGC restart DoS attack
• BZ - 802489 - CVE-2012-1165 openssl: mime_param_cmp NULL dereference crash
• BZ - 802725 - CVE-2012-0884 openssl: CMS and PKCS#7 Bleichenbacher attack
• BZ - 814185 - CVE-2012-2110 openssl: asn1_d2i_read_bio integer errors leading to buffer overflow
• BZ - 820686 - CVE-2012-2333 openssl: record length handling integer underflow

CVEs

• CVE-2011-4108
• CVE-2011-4109
• CVE-2011-4576
• CVE-2011-4619
• CVE-2012-0884
• CVE-2012-1165
• CVE-2012-2110
• CVE-2012-2333

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver&downloadType=securityPatches&version=1.0.2