RHSA-2014:0253 - Security Advisory

Topic

Updated Red Hat JBoss Enterprise Application Platform 6.2.1 packages that
fix one security issue are now available for Red Hat Enterprise Linux 5
and 6.

The Red Hat Security Response Team has rated this update as having Moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java
applications based on JBoss Application Server 7.

A denial of service flaw was found in the way Apache Commons FileUpload,
which is embedded in the JBoss Web component of JBoss EAP, handled
small-sized buffers used by MultipartStream. A remote attacker could use
this flaw to create a malformed Content-Type header for a multipart
request, causing JBoss Web to enter an infinite loop when processing such
an incoming request. (CVE-2014-0050)

Warning: Before applying this update, back up your existing Red Hat JBoss
Enterprise Application Platform installation and deployed applications.

All users of Red Hat JBoss Enterprise Application Platform 6.2.1 on Red Hat
Enterprise Linux 5 and 6 are advised to upgrade to these updated packages.
The JBoss server process must be restarted for the update to take effect.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied. Also, back up any customized Red
Hat JBoss Enterprise Application Platform 6 configuration files. On update,
the configuration files that have been locally modified will not be
updated. The updated version of such files will be stored as the rpmnew
files. Make sure to locate any such files after the update and merge any
changes manually.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• JBoss Enterprise Application Platform from RHUI 6 x86_64
• JBoss Enterprise Application Platform from RHUI 6 i386
• JBoss Enterprise Application Platform 6.4 for RHEL 6 x86_64
• JBoss Enterprise Application Platform 6.4 for RHEL 6 i386
• JBoss Enterprise Application Platform 6.4 for RHEL 5 x86_64
• JBoss Enterprise Application Platform 6.4 for RHEL 5 i386
• JBoss Enterprise Application Platform 6 for RHEL 6 x86_64
• JBoss Enterprise Application Platform 6 for RHEL 6 i386
• JBoss Enterprise Application Platform 6 for RHEL 5 x86_64
• JBoss Enterprise Application Platform 6 for RHEL 5 i386

Fixes

• BZ - 1062337 - CVE-2014-0050 apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream

CVEs

• CVE-2014-0050

References

• https://access.redhat.com/security/updates/classification/#moderate