RHSA-2017:1414 - Security Advisory

Topic

An update is now available for Red Hat JBoss Core Services on RHEL 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.

This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.23, and includes bug fixes, which are documented in the Release Notes document linked to in the References.

Security Fix(es):

• A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304)
• It was discovered that the mod_session_crypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack. (CVE-2016-0736)
• It was discovered that the mod_auth_digest module of httpd did not properly check for memory allocation failures. A remote attacker could use this flaw to cause httpd child processes to repeatedly crash if the server used HTTP digest authentication. (CVE-2016-2161)
• A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys. (CVE-2016-7056)
• A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. (CVE-2016-8610)
• It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a remote attacker could possibly use this flaw to inject data into HTTP responses, resulting in proxy cache poisoning. (CVE-2016-8743)
• A vulnerability was found in httpd's handling of the LimitRequestFields directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker could send crafted requests with headers larger than the server's available memory, causing httpd to crash. (CVE-2016-8740)

Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6304 and Shi Lei (Gear Team of Qihoo 360 Inc.) for reporting CVE-2016-8610. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6304.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.

Affected Products

• Red Hat JBoss Core Services 1 for RHEL 6 x86_64
• Red Hat JBoss Core Services 1 for RHEL 6 ppc64
• Red Hat JBoss Core Services 1 for RHEL 6 i386

Fixes

• BZ - 1377600 - CVE-2016-6304 openssl: OCSP Status Request extension unbounded memory growth
• BZ - 1384743 - CVE-2016-8610 SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS
• BZ - 1401528 - CVE-2016-8740 httpd: Incomplete handling of LimitRequestFields directive in mod_http2
• BZ - 1406744 - CVE-2016-0736 httpd: Padding Oracle in Apache mod_session_crypto
• BZ - 1406753 - CVE-2016-2161 httpd: DoS vulnerability in mod_auth_digest
• BZ - 1406822 - CVE-2016-8743 httpd: Apache HTTP Request Parsing Whitespace Defects
• BZ - 1412120 - CVE-2016-7056 openssl: ECDSA P-256 timing attack key recovery

CVEs

• CVE-2016-0736
• CVE-2016-2161
• CVE-2016-6304
• CVE-2016-7056
• CVE-2016-8610
• CVE-2016-8740
• CVE-2016-8743

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/documentation/en/red-hat-jboss-core-services/