Synopsis

Important: JBoss Enterprise Application Platform 5.2.0 security update

Type/Severity

Security Advisory: Important

Topic

Updated packages for JBoss Enterprise Application Platform 5.2.0 which fix
one security issue are now available for Red Hat Enterprise Linux 4, 5,
and 6.

The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

Description

JBoss Enterprise Application Platform is a platform for Java applications,
which integrates the JBoss Application Server with JBoss Hibernate and
JBoss Seam.

XML encryption backwards compatibility attacks were found against various
frameworks, including Apache CXF. An attacker could force a server to use
insecure, legacy cryptosystems, even when secure cryptosystems were enabled
on endpoints. By forcing the use of legacy cryptosystems, flaws such as
CVE-2011-1096 and CVE-2011-2487 would be exposed, allowing plain text to be
recovered from cryptograms and symmetric keys. This issue affected both the
JBoss Web Services CXF (jbossws-cxf) and JBoss Web Services Native
(jbossws-native) stacks. (CVE-2012-5575)

Red Hat would like to thank Tibor Jager, Kenneth G. Paterson and Juraj
Somorovsky of Ruhr-University Bochum for reporting this issue.

If you are using jbossws-cxf, then automatic checks to prevent this flaw
are only run when WS-SecurityPolicy is used to enforce security
requirements. It is best practice to use WS-SecurityPolicy to enforce
security requirements.

If you are using jbossws-native, the fix for this flaw is implemented by
two new configuration parameters in the 'encryption' element. This element
can be a child of 'requires' in both client and server wsse configuration
descriptors (set on a per-application basis via the application's
jboss-wsse-server.xml and jboss-wsse-client.xml files). The new attributes
are 'algorithms' and 'keyWrapAlgorithms'. These attributes should contain a
blank space or comma separated list of algorithm IDs that are allowed for
the encrypted incoming message, both for encryption and private key
wrapping. For backwards compatibility, no algorithm checks are performed by
default for empty lists or missing attributes.

For example (do not include the line break in your configuration):

encryption algorithms="aes-192-gcm aes-256-gcm"
keyWrapAlgorithms="rsa_oaep"

Specifies that incoming messages are required to be encrypted, and that the
only permitted encryption algorithms are AES-192 and 256 in GCM mode, and
RSA-OAEP only for key wrapping.

Before performing any decryption, the jbossws-native stack will verify that
each algorithm specified in the incoming messages is included in the
allowed algorithms lists from these new encryption element attributes. The
algorithm values to be used for 'algorithms' and 'keyWrapAlgorithms' are
the same as for 'algorithm' and 'keyWrapAlgorithm' in the 'encrypt'
element.

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of JBoss Enterprise Application Platform 5.2.0 on Red Hat
Enterprise Linux 4, 5, and 6 are advised to upgrade to these updated
packages. The JBoss server process must be restarted for the update to take
effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• JBoss Enterprise Application Platform from RHUI 5 x86_64
• JBoss Enterprise Application Platform from RHUI 5 i386
• JBoss Enterprise Application Platform 5 for RHEL 6 x86_64
• JBoss Enterprise Application Platform 5 for RHEL 6 i386
• JBoss Enterprise Application Platform 5 for RHEL 5 x86_64
• JBoss Enterprise Application Platform 5 for RHEL 5 i386

Fixes

• BZ - 880443 - CVE-2012-5575 jbossws-native, jbossws-cxf, apache-cxf: XML encryption backwards compatibility attacks

CVEs

• CVE-2012-5575

References

• https://access.redhat.com/security/updates/classification/#important
• http://ws.apache.org/wss4j/best_practice.html
• http://cxf.apache.org/cve-2012-5575.html

JBoss Enterprise Application Platform from RHUI 5

SRPM
apache-cxf-2.2.12-12.patch_07.ep5.el6.src.rpm	SHA-256: be5fea942e2ce874d2547919219563b5feb602fb5d7f9625e64457f765dafc0a
jbossws-3.1.2-14.SP15_patch_02.ep5.el6.src.rpm	SHA-256: 414a71ed9ec37e0d24f966cbbf5001bc2dd5420f8cc7dbb152d4b963edc0a5c7
wss4j-1.5.12-6_patch_03.ep5.el6.src.rpm	SHA-256: a42af1a3d9662bd1e6c1ed768a5317845dd5e7006425c3d2d0451c4c22c5898e
x86_64
apache-cxf-2.2.12-12.patch_07.ep5.el6.noarch.rpm	SHA-256: 6767a323837984ce1cc474fbd1afc6be5e7959ed1a586f2fb06f267fa5d270d9
jbossws-3.1.2-14.SP15_patch_02.ep5.el6.noarch.rpm	SHA-256: 281a682225aa1b7f649f3000cce511b5ff84addc127d419679ef0ff6c9221249
wss4j-1.5.12-6_patch_03.ep5.el6.noarch.rpm	SHA-256: 72b063d921a1f76532146d4f1d10d0e3eafca8b0771db0497c80010e757cbd50
i386
apache-cxf-2.2.12-12.patch_07.ep5.el6.noarch.rpm	SHA-256: 6767a323837984ce1cc474fbd1afc6be5e7959ed1a586f2fb06f267fa5d270d9
jbossws-3.1.2-14.SP15_patch_02.ep5.el6.noarch.rpm	SHA-256: 281a682225aa1b7f649f3000cce511b5ff84addc127d419679ef0ff6c9221249
wss4j-1.5.12-6_patch_03.ep5.el6.noarch.rpm	SHA-256: 72b063d921a1f76532146d4f1d10d0e3eafca8b0771db0497c80010e757cbd50

JBoss Enterprise Application Platform 5 for RHEL 6

SRPM
apache-cxf-2.2.12-12.patch_07.ep5.el6.src.rpm	SHA-256: be5fea942e2ce874d2547919219563b5feb602fb5d7f9625e64457f765dafc0a
jbossws-3.1.2-14.SP15_patch_02.ep5.el6.src.rpm	SHA-256: 414a71ed9ec37e0d24f966cbbf5001bc2dd5420f8cc7dbb152d4b963edc0a5c7
wss4j-1.5.12-6_patch_03.ep5.el6.src.rpm	SHA-256: a42af1a3d9662bd1e6c1ed768a5317845dd5e7006425c3d2d0451c4c22c5898e
x86_64
apache-cxf-2.2.12-12.patch_07.ep5.el6.noarch.rpm	SHA-256: 6767a323837984ce1cc474fbd1afc6be5e7959ed1a586f2fb06f267fa5d270d9
jbossws-3.1.2-14.SP15_patch_02.ep5.el6.noarch.rpm	SHA-256: 281a682225aa1b7f649f3000cce511b5ff84addc127d419679ef0ff6c9221249
wss4j-1.5.12-6_patch_03.ep5.el6.noarch.rpm	SHA-256: 72b063d921a1f76532146d4f1d10d0e3eafca8b0771db0497c80010e757cbd50
i386
apache-cxf-2.2.12-12.patch_07.ep5.el6.noarch.rpm	SHA-256: 6767a323837984ce1cc474fbd1afc6be5e7959ed1a586f2fb06f267fa5d270d9
jbossws-3.1.2-14.SP15_patch_02.ep5.el6.noarch.rpm	SHA-256: 281a682225aa1b7f649f3000cce511b5ff84addc127d419679ef0ff6c9221249
wss4j-1.5.12-6_patch_03.ep5.el6.noarch.rpm	SHA-256: 72b063d921a1f76532146d4f1d10d0e3eafca8b0771db0497c80010e757cbd50

JBoss Enterprise Application Platform 5 for RHEL 5

SRPM
apache-cxf-2.2.12-12.patch_07.ep5.el5.src.rpm	SHA-256: c7afd9ae97567a4bae9f37a23f013ef9f5beeaad90cec1a07d94bedb6ac3138f
jbossws-3.1.2-14.SP15_patch_02.ep5.el5.src.rpm	SHA-256: 89752dcfad131114be845e1a0bfeaceecf5a5c7f4a5e6032de2b9ce04dec8662
wss4j-1.5.12-6_patch_03.ep5.el5.src.rpm	SHA-256: 02be4dc4ea7ebd13eb2e947adeab4337d7553fbdc915b1aec5e794d93975a365
x86_64
apache-cxf-2.2.12-12.patch_07.ep5.el5.noarch.rpm	SHA-256: 6aedaea16f0f4b6772e76c8034280757d406a01e1ad596d2e01a8122c5e5389b
jbossws-3.1.2-14.SP15_patch_02.ep5.el5.noarch.rpm	SHA-256: 0cc585cbffcd27342a7e0900039bb02457555cea61b7eb73d1db34b5aab7778a
wss4j-1.5.12-6_patch_03.ep5.el5.noarch.rpm	SHA-256: 6cb2d28922ccddb45ffdfa86829239db14dcee81da18258fe1ad6379692f922f
i386
apache-cxf-2.2.12-12.patch_07.ep5.el5.noarch.rpm	SHA-256: 6aedaea16f0f4b6772e76c8034280757d406a01e1ad596d2e01a8122c5e5389b
jbossws-3.1.2-14.SP15_patch_02.ep5.el5.noarch.rpm	SHA-256: 0cc585cbffcd27342a7e0900039bb02457555cea61b7eb73d1db34b5aab7778a
wss4j-1.5.12-6_patch_03.ep5.el5.noarch.rpm	SHA-256: 6cb2d28922ccddb45ffdfa86829239db14dcee81da18258fe1ad6379692f922f