Synopsis

Moderate: Red Hat JBoss Enterprise Application Platform 6.2.1 security update

Type/Severity

Security Advisory: Moderate

Topic

Updated Red Hat JBoss Enterprise Application Platform 6.2.1 packages that
fix one security issue are now available for Red Hat Enterprise Linux 5
and 6.

The Red Hat Security Response Team has rated this update as having Moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java
applications based on JBoss Application Server 7.

A denial of service flaw was found in the way Apache Commons FileUpload,
which is embedded in the JBoss Web component of JBoss EAP, handled
small-sized buffers used by MultipartStream. A remote attacker could use
this flaw to create a malformed Content-Type header for a multipart
request, causing JBoss Web to enter an infinite loop when processing such
an incoming request. (CVE-2014-0050)

Warning: Before applying this update, back up your existing Red Hat JBoss
Enterprise Application Platform installation and deployed applications.

All users of Red Hat JBoss Enterprise Application Platform 6.2.1 on Red Hat
Enterprise Linux 5 and 6 are advised to upgrade to these updated packages.
The JBoss server process must be restarted for the update to take effect.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied. Also, back up any customized Red
Hat JBoss Enterprise Application Platform 6 configuration files. On update,
the configuration files that have been locally modified will not be
updated. The updated version of such files will be stored as the rpmnew
files. Make sure to locate any such files after the update and merge any
changes manually.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• JBoss Enterprise Application Platform from RHUI 6 x86_64
• JBoss Enterprise Application Platform from RHUI 6 i386
• JBoss Enterprise Application Platform 6.4 for RHEL 6 x86_64
• JBoss Enterprise Application Platform 6.4 for RHEL 6 i386
• JBoss Enterprise Application Platform 6.4 for RHEL 5 x86_64
• JBoss Enterprise Application Platform 6.4 for RHEL 5 i386
• JBoss Enterprise Application Platform 6 for RHEL 6 x86_64
• JBoss Enterprise Application Platform 6 for RHEL 6 i386
• JBoss Enterprise Application Platform 6 for RHEL 5 x86_64
• JBoss Enterprise Application Platform 6 for RHEL 5 i386

Fixes

• BZ - 1062337 - CVE-2014-0050 apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream

CVEs

• CVE-2014-0050

References

• https://access.redhat.com/security/updates/classification/#moderate

JBoss Enterprise Application Platform 6.4 for RHEL 6

SRPM
jbossweb-7.3.0-2.Final_redhat_2.1.ep6.el6.src.rpm	SHA-256: 98996da541f62470ef4107e32d4c3dd6477f22fd8f2ea90f55f198263677b6b7
x86_64
jbossweb-7.3.0-2.Final_redhat_2.1.ep6.el6.noarch.rpm	SHA-256: 688d0e51d91d725d34103a6bf3b75f181e62a7673f4860fb55e70b27b32e169a
i386
jbossweb-7.3.0-2.Final_redhat_2.1.ep6.el6.noarch.rpm	SHA-256: 688d0e51d91d725d34103a6bf3b75f181e62a7673f4860fb55e70b27b32e169a

JBoss Enterprise Application Platform 6.4 for RHEL 5

SRPM
jbossweb-7.3.0-2.Final_redhat_2.1.ep6.el5.src.rpm	SHA-256: 03e7a0ee3a7dc9dafb56313770f6042c13a86d10625cc77502ee3b1ab338301c
x86_64
jbossweb-7.3.0-2.Final_redhat_2.1.ep6.el5.noarch.rpm	SHA-256: 65144e0dfbce6685b0d47034eb5047dec268ba09aeb4155a47ae51efe77aa9da
i386
jbossweb-7.3.0-2.Final_redhat_2.1.ep6.el5.noarch.rpm	SHA-256: 65144e0dfbce6685b0d47034eb5047dec268ba09aeb4155a47ae51efe77aa9da

JBoss Enterprise Application Platform 6 for RHEL 6

SRPM
jbossweb-7.3.0-2.Final_redhat_2.1.ep6.el6.src.rpm	SHA-256: 98996da541f62470ef4107e32d4c3dd6477f22fd8f2ea90f55f198263677b6b7
x86_64
jbossweb-7.3.0-2.Final_redhat_2.1.ep6.el6.noarch.rpm	SHA-256: 688d0e51d91d725d34103a6bf3b75f181e62a7673f4860fb55e70b27b32e169a
i386
jbossweb-7.3.0-2.Final_redhat_2.1.ep6.el6.noarch.rpm	SHA-256: 688d0e51d91d725d34103a6bf3b75f181e62a7673f4860fb55e70b27b32e169a

JBoss Enterprise Application Platform 6 for RHEL 5

SRPM
jbossweb-7.3.0-2.Final_redhat_2.1.ep6.el5.src.rpm	SHA-256: 03e7a0ee3a7dc9dafb56313770f6042c13a86d10625cc77502ee3b1ab338301c
x86_64
jbossweb-7.3.0-2.Final_redhat_2.1.ep6.el5.noarch.rpm	SHA-256: 65144e0dfbce6685b0d47034eb5047dec268ba09aeb4155a47ae51efe77aa9da
i386
jbossweb-7.3.0-2.Final_redhat_2.1.ep6.el5.noarch.rpm	SHA-256: 65144e0dfbce6685b0d47034eb5047dec268ba09aeb4155a47ae51efe77aa9da