Synopsis

Important: Red Hat JBoss Enterprise Application Platform 6.2.4 security update

Type/Severity

Security Advisory: Important

Topic

Updated Red Hat JBoss Enterprise Application Platform 6.2.4 packages that
fix one security issue are now available for Red Hat Enterprise Linux 5
and 6.

The Red Hat Security Response Team has rated this update as having
Important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

Description

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java
applications based on JBoss Application Server 7.

It was found that the implementation of the
org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method
provided a DocumentBuilderFactory that would expand entity references.
A remote, unauthenticated attacker could use this flaw to read files
accessible to the user running the application server, and potentially
perform other more advanced XXE attacks. (CVE-2014-3530)

Red Hat would like to thank Alexander Papadakis for reporting this issue.

All users of Red Hat JBoss Enterprise Application Platform 6.2.4 on Red Hat
Enterprise Linux 5 and 6 are advised to upgrade to these updated packages.
The JBoss server process must be restarted for the update to take effect.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied. Also, back up any customized Red
Hat JBoss Enterprise Application Platform 6 configuration files. On update,
the configuration files that have been locally modified will not be
updated. The updated version of such files will be stored as the rpmnew
files. Make sure to locate any such files after the update and merge any
changes manually.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

Affected Products

• JBoss Enterprise Application Platform from RHUI 6 x86_64
• JBoss Enterprise Application Platform from RHUI 6 i386
• JBoss Enterprise Application Platform 6.4 for RHEL 6 x86_64
• JBoss Enterprise Application Platform 6.4 for RHEL 6 i386
• JBoss Enterprise Application Platform 6.4 for RHEL 5 x86_64
• JBoss Enterprise Application Platform 6.4 for RHEL 5 i386
• JBoss Enterprise Application Platform 6 for RHEL 6 x86_64
• JBoss Enterprise Application Platform 6 for RHEL 6 i386
• JBoss Enterprise Application Platform 6 for RHEL 5 x86_64
• JBoss Enterprise Application Platform 6 for RHEL 5 i386

Fixes

• BZ - 1112987 - CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage

CVEs

• CVE-2014-3530

References

• https://access.redhat.com/security/updates/classification/#important

JBoss Enterprise Application Platform from RHUI 6

SRPM
picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el6.src.rpm	SHA-256: e44e81f5effa2ddfed5c6cac7168f90ea1c95225fdb38e342f441260ada2f62b
x86_64
picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el6.noarch.rpm	SHA-256: 210a8bedfec5c35225dff0fe5f2f54bc7f45d091a59621c74db8bab266efb3f6
i386
picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el6.noarch.rpm	SHA-256: 210a8bedfec5c35225dff0fe5f2f54bc7f45d091a59621c74db8bab266efb3f6

JBoss Enterprise Application Platform 6.4 for RHEL 6

SRPM
picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el6.src.rpm	SHA-256: e44e81f5effa2ddfed5c6cac7168f90ea1c95225fdb38e342f441260ada2f62b
x86_64
picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el6.noarch.rpm	SHA-256: 210a8bedfec5c35225dff0fe5f2f54bc7f45d091a59621c74db8bab266efb3f6
i386
picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el6.noarch.rpm	SHA-256: 210a8bedfec5c35225dff0fe5f2f54bc7f45d091a59621c74db8bab266efb3f6

JBoss Enterprise Application Platform 6.4 for RHEL 5

SRPM
picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el5.src.rpm	SHA-256: 38cab80897b78eab50a4fc4921b9a610121f09778e6643f1feb87f488ab62dd6
x86_64
picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el5.noarch.rpm	SHA-256: 4f9fb84e3ce833afe88ecf0086fd59fc1bccc01a3b3cc5088a9813e76fb66446
i386
picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el5.noarch.rpm	SHA-256: 4f9fb84e3ce833afe88ecf0086fd59fc1bccc01a3b3cc5088a9813e76fb66446

JBoss Enterprise Application Platform 6 for RHEL 6

SRPM
picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el6.src.rpm	SHA-256: e44e81f5effa2ddfed5c6cac7168f90ea1c95225fdb38e342f441260ada2f62b
x86_64
picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el6.noarch.rpm	SHA-256: 210a8bedfec5c35225dff0fe5f2f54bc7f45d091a59621c74db8bab266efb3f6
i386
picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el6.noarch.rpm	SHA-256: 210a8bedfec5c35225dff0fe5f2f54bc7f45d091a59621c74db8bab266efb3f6

JBoss Enterprise Application Platform 6 for RHEL 5

SRPM
picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el5.src.rpm	SHA-256: 38cab80897b78eab50a4fc4921b9a610121f09778e6643f1feb87f488ab62dd6
x86_64
picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el5.noarch.rpm	SHA-256: 4f9fb84e3ce833afe88ecf0086fd59fc1bccc01a3b3cc5088a9813e76fb66446
i386
picketlink-federation-2.1.9-5.SP3_redhat_2.1.ep6.el5.noarch.rpm	SHA-256: 4f9fb84e3ce833afe88ecf0086fd59fc1bccc01a3b3cc5088a9813e76fb66446