Red Hat Product Errata RHSA-2013:0249 - Security Advisory
Issued:
2013-02-11
Updated:
2013-02-11

RHSA-2013:0249 - Security Advisory

Synopsis

Important: JBoss Enterprise Application Platform 4.3.0 CP10 security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Updated JBoss Enterprise Application Platform 4.3.0 CP10 packages that fix
one security issue are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

Description

JBoss Enterprise Application Platform is a platform for Java applications,
which integrates the JBoss Application Server with JBoss Hibernate and
JBoss Seam.

When using LDAP authentication with the provided LDAP login modules
(LdapLoginModule/LdapExtLoginModule), empty passwords were allowed by
default. An attacker could use this flaw to bypass intended authentication
by providing an empty password for a valid username, as the LDAP server may
recognize this as an 'unauthenticated authentication' (RFC 4513). This
update sets the allowEmptyPasswords option for the LDAP login modules to
false if the option is not already configured. (CVE-2012-5629)

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of JBoss Enterprise Application Platform 4.3.0 CP10 on Red Hat
Enterprise Linux 4 and 5 are advised to upgrade to these updated packages.
The JBoss server process must be restarted for the update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 4.3.0 x86_64
  • JBoss Enterprise Application Platform 4.3.0 i386

Fixes

  • BZ - 885569 - CVE-2012-5629 JBoss: allows empty password to authenticate against LDAP

JBoss Enterprise Application Platform 4.3.0

SRPM
jbossas-4.3.0-12.GA_CP10_patch_01.1.ep1.el5.src.rpm SHA-256: 45946b85a4259b7de6d1ea5a4588feb95d08c358913aefc6ad8deb32d2e47445
x86_64
jbossas-4.3.0-12.GA_CP10_patch_01.1.ep1.el5.noarch.rpm SHA-256: 9ea0b554830a5902df29fe5520e0764a5a1d5580842d258723010a7dc508e682
jbossas-client-4.3.0-12.GA_CP10_patch_01.1.ep1.el5.noarch.rpm SHA-256: af9ff7c4443b92eb9561f2e8423d3f3f83cf1b21f0394544c276c93137645de3
i386
jbossas-4.3.0-12.GA_CP10_patch_01.1.ep1.el5.noarch.rpm SHA-256: 9ea0b554830a5902df29fe5520e0764a5a1d5580842d258723010a7dc508e682
jbossas-client-4.3.0-12.GA_CP10_patch_01.1.ep1.el5.noarch.rpm SHA-256: af9ff7c4443b92eb9561f2e8423d3f3f83cf1b21f0394544c276c93137645de3

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.