RHSA-2013:0839 - Security Advisory

Topic

Updated JBoss Enterprise Application Platform 6.1.0 packages that fix
three security issues, various bugs, and add enhancements are now
available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

Description

JBoss Enterprise Application Platform 6 is a platform for Java applications
based on JBoss Application Server 7.

This release serves as a replacement for JBoss Enterprise Application
Platform 6.0.1, and includes bug fixes and enhancements. Refer to the 6.1.0
Release Notes for information on the most significant of these changes,
available shortly from https://access.redhat.com/site/documentation/

Security fixes:

XML encryption backwards compatibility attacks were found against various
frameworks, including Apache CXF. An attacker could force a server to use
insecure, legacy cryptosystems, even when secure cryptosystems were enabled
on endpoints. By forcing the use of legacy cryptosystems, flaws such as
CVE-2011-1096 and CVE-2011-2487 would be exposed, allowing plain text to be
recovered from cryptograms and symmetric keys. (CVE-2012-5575)

Note: Automatic checks to prevent CVE-2012-5575 are only run when
WS-SecurityPolicy is used to enforce security requirements. It is best
practice to use WS-SecurityPolicy to enforce security requirements.

When applications running on JBoss Web used the COOKIE session tracking
method, the org.apache.catalina.connector.Response.encodeURL() method
returned the URL with the jsessionid appended as a query string parameter
when processing the first request of a session. An attacker could possibly
exploit this flaw by performing a man-in-the-middle attack to obtain a
user's jsessionid and hijack their session, or by extracting the jsessionid
from log files. Note that no session tracking method is used by default,
one must be configured. (CVE-2012-4529)

If multiple applications used the same custom authorization module class
name, and provided their own implementations of it, the first application
to be loaded will have its implementation used for all other applications
using the same custom authorization module class name. A local attacker
could use this flaw to deploy a malicious application that provides
implementations of custom authorization modules that permit or deny user
access according to rules supplied by the attacker. (CVE-2012-4572)

Red Hat would like to thank Tibor Jager, Kenneth G. Paterson and Juraj
Somorovsky of Ruhr-University Bochum for reporting CVE-2012-5575.
CVE-2012-4572 was discovered by Josef Cacek of the Red Hat JBoss EAP
Quality Engineering team.

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation and deployed applications.
Refer to the Solution section for further details.

All users of JBoss Enterprise Application Platform 6.0.1 on Red Hat
Enterprise Linux 5 are advised to upgrade to these updated packages. The
JBoss server process must be restarted for the update to take effect.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied. Also, back up any customized
JBoss Enterprise Application Platform 6 configuration files. On update, the
configuration files that have been locally modified will not be updated.
The updated version of such files will be stored as the rpmnew files. Make
sure to locate any such files after the update and merge any changes
manually.

For more details, refer to the Release Notes for JBoss Enterprise
Application Platform 6.1.0, available shortly from
https://access.redhat.com/site/documentation/

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• JBoss Enterprise Application Platform 6.4 for RHEL 5 x86_64
• JBoss Enterprise Application Platform 6.4 for RHEL 5 i386
• JBoss Enterprise Application Platform 6 for RHEL 5 x86_64
• JBoss Enterprise Application Platform 6 for RHEL 5 i386

Fixes

• BZ - 868202 - CVE-2012-4529 JBoss Web: jsessionid exposed via encoded url when using cookie based session tracking
• BZ - 872059 - CVE-2012-4572 JBoss: custom authorization module implementations shared between applications
• BZ - 880443 - CVE-2012-5575 jbossws-native, jbossws-cxf, apache-cxf: XML encryption backwards compatibility attacks

CVEs

• CVE-2012-5575
• CVE-2012-4572
• CVE-2012-4529
• CVE-2013-2067

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/site/documentation/
• http://cxf.apache.org/cve-2012-5575.html