JBoss - CVE-2010-0738 - "kisses" worm removal

Solution Verified - Updated -

Environment

Red Hat JBoss Enterprise  Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and  4.3 before 4.3.0.CP08

Issue

https://www.redhat.com/security/data/cve/CVE-2010-0738.html

https://access.redhat.com/kb/docs/DOC-30741

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise  Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and  4.3 before 4.3.0.CP08 performs access control only for the GET and POST  methods, which allows remote attackers to send requests to this  application's GET handler by using a different method.

Resolution

Aside of upgrading to a non affected version you can easily configure your existing install to stop this attack.

Stop de JBoss server.
Edit the file: "$JBOSS_HOME/server/&PROFILE/deploy/jmx-console.war/WEB-INF/web.xml"

remove these two lines from the security constraints - this will make sure that all methods are secure:

<http-method>GET</http-method>
<http-method>POST</http-method>
~~

Remove the actual worm:

cd $JBOSS_HOME/server/&PROFILE/deploy
rm -rf zGiruLqk.war UIcAPtyd.war siPmbGje.war cCnbiguv.war

cd $JBOSS_HOME/server/&PROFILE/deploy/management
rm -rf iesvc.war zecmd.war WuPCvwTH.war iesvc.war idssvc.war fXWrkyBQ.war foo2.war

Note that the above list might not be exhaustive nor that your system will actually have some of them.
The names seem to be more or less random.

When in doubt, open the war files: the virus one contains one jsp file with a random name.

Remove the payload:

find / -iname kisses.tar.gz -type f | xargs rm -f
find / -iname kisses -type d | xargs rm -rf
~~~

If not already done as per the installation docs, don't forget to make your jmx console secure; please follow this article

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments