Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
(Red Hat Issues Fix) JBoss Enterprise SOA httpha-invoker Bug Lets Remote Users Bypass Access Controls
|
|
SecurityTracker Alert ID: 1027199 |
|
SecurityTracker URL: http://securitytracker.com/id/1027199
|
|
CVE Reference:
CVE-2011-4085
(Links to External Site)
|
Date: Jun 22 2012
|
Impact:
Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
Two vulnerabilities were reported in JBoss Enterprise SOA. A remote user can conduct cross-site scripting attacks. A remote user can bypass access controls.
A remote user can send a specially crafted HTTP request to bypass the first layer of authentication for the invoker servlets deployed by httpha-invoker [CVE-2011-4085]. On systems were the security interceptor is misconfigured or disabled, a remote user can exploit this flaw to access resources on the target system.
The included JRuby component does not properly filter HTML code from user-supplied input before displaying the input [CVE-2010-1330]. A remote user can cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the JBoss software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
|
Impact:
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the JBoss software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A remote user can bypass first level access controls.
|
Solution:
Red Hat has issued a fix for CVE-2011-4085 for JBoss Enterprise BRMS Platform.
The Red Hat advisory is available at:
https://rhn.redhat.com/errata/RHSA-2012-1028.html
|
Vendor URL: rhn.redhat.com/errata/RHSA-2011-1456.html (Links to External Site)
|
Cause:
Access control error, Input validation error
|
Underlying OS:
Linux (Red Hat Enterprise)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Fri, 22 Jun 2012 21:14:14 +0000
Subject: http://rhn.redhat.com/errata/RHSA-2012-1028.html
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: JBoss Enterprise BRMS Platform 5.3.0 update
Advisory ID: RHSA-2012:1028-01
Product: JBoss Enterprise Middleware
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-1028.html
Issue date: 2012-06-22
CVE Names: CVE-2011-4085 CVE-2011-4605 CVE-2012-2377
=====================================================================
1. Summary:
JBoss Enterprise BRMS Platform 5.3.0, which fixes multiple security issues,
various bugs, and adds enhancements is now available from the Red Hat
Customer Portal.
The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
2. Description:
JBoss Enterprise BRMS Platform is a business rules management system for
the management, storage, creation, modification, and deployment of JBoss
Rules. The Java Naming and Directory Interface (JNDI) Java API allows Java
software clients to locate objects or services in an application server.
This release of JBoss Enterprise BRMS Platform 5.3.0 serves as a
replacement for JBoss Enterprise BRMS Platform 5.2.0. It includes various
bug fixes and enhancements which are detailed in the JBoss Enterprise BRMS
Platform 5.3.0 Release Notes. The Release Notes will be available shortly
from https://docs.redhat.com/docs/en-US/index.html
The following security issues are also fixed with this release:
It was found that the JBoss JNDI service allowed unauthenticated, remote
write access by default. The JNDI and HA-JNDI services, and the
HAJNDIFactory invoker servlet were all affected. A remote attacker able to
access the JNDI service (port 1099), HA-JNDI service (port 1100), or the
HAJNDIFactory invoker servlet on a JBoss server could use this flaw to add,
delete, and modify items in the JNDI tree. This could have various,
application-specific impacts. (CVE-2011-4605)
It was found that the invoker servlets, deployed by default via
httpha-invoker, only performed access control on the HTTP GET and POST
methods, allowing remote attackers to make unauthenticated requests by
using different HTTP methods. Due to the second layer of authentication
provided by a security interceptor, this issue is not exploitable on
default installations unless an administrator has misconfigured the
security interceptor or disabled it. (CVE-2011-4085)
When a JGroups channel is started, the JGroups diagnostics service would be
enabled by default with no authentication. This service is exposed via IP
multicast. An attacker on an adjacent network could exploit this flaw to
read diagnostics information. (CVE-2012-2377)
Red Hat would like to thank Christian Schlüter (VIADA) for reporting
CVE-2011-4605.
Warning: Before applying the update, back up your existing JBoss Enterprise
BRMS Platform installation (including its databases, applications,
configuration files, and so on).
All users of JBoss Enterprise BRMS Platform 5.2.0 as provided from the Red
Hat Customer Portal are advised to upgrade to JBoss Enterprise BRMS
Platform 5.3.0.
3. Solution:
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing JBoss Enterprise BRMS Platform installation (including its
databases, applications, configuration files, and so on).
4. Bugs fixed (http://bugzilla.redhat.com/):
750422 - CVE-2011-4085 Invoker servlets authentication bypass (HTTP verb tampering)
766469 - CVE-2011-4605 JNDI: unauthenticated remote write access is permitted by default
823392 - CVE-2012-2377 JGroups diagnostics service enabled by default with no authentication when a JGroups channel is started
5. References:
https://www.redhat.com/security/data/cve/CVE-2011-4085.html
https://www.redhat.com/security/data/cve/CVE-2011-4605.html
https://www.redhat.com/security/data/cve/CVE-2012-2377.html
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms&downloadType=distributions
https://docs.redhat.com/docs/en-US/index.html
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFP48ppXlSAg2UNWIIRAuvfAJkBEt7BGoBnd0xBiy8+LLUIEP1kmgCgoZ4P
KdN4iIuXKzcJeDfIPCIULtw=
=D4Vt
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
|
|
Go to the Top of This SecurityTracker Archive Page
|
