SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Web Server/CGI)  >   JBoss Vendors:   Red Hat
JBoss Enterprise Application Platform Bugs Let Local Users Gain Elevated Privileges and Remote Authenticated Users Bypass Security Controls
SecurityTracker Alert ID:  1029431
SecurityTracker URL:  http://securitytracker.com/id/1029431
CVE Reference:   CVE-2013-2035, CVE-2013-2133   (Links to External Site)
Updated:  Dec 15 2014
Original Entry Date:  Dec 4 2013
Impact:   Execution of arbitrary code via network, User access via local system, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   Two vulnerabilities were reported in JBoss Enterprise Application Platform. A remote authenticated user can bypass security controls. A local user can obtain elevated privileges on the target system.

The HawtJNI Library class writes native libraries to a predictable file name in the '/tmp' directory in certain cases. A local user can overwrite the files before they are executed [CVE-2013-2035].

Florian Weimer of the Red Hat Product Security Team reported this vulnerability.

A remote authenticated user can exploit a flaw in the EJB invocation handler implementation when performing method-level authorization for JAX-WS Service endpoints to invoke a JAX-WS handler that they are not authorized to invoke [CVE-2013-2133].

Richard Opalka and Arun Neelicattu of Red Hat reported this vulnerability.

Impact:   A remote authenticated user can invoke a JAX-WS handler that they are not authorized to invoke.

A local user can obtain elevated privileges on the target system.

Solution:   The vendor has issued a fix.

The vendor's advisories are available at:

https://rhn.redhat.com/errata/RHSA-2013-1784.html
https://rhn.redhat.com/errata/RHSA-2013-1785.html
https://rhn.redhat.com/errata/RHSA-2013-1786.html
https://rhn.redhat.com/errata/RHSA-2014-1995.html

Vendor URL:  rhn.redhat.com/errata/RHSA-2013-1784.html (Links to External Site)
Cause:   Access control error
Underlying OS:   Linux (Red Hat Enterprise)

Message History:   None.


 Source Message Contents

Date:  Wed, 4 Dec 2013 18:33:28 +0000
Subject:  [RHSA-2013:1784-01] Low: Red Hat JBoss Enterprise Application Platform 6.2.0 update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Low: Red Hat JBoss Enterprise Application Platform 6.2.0 update
Advisory ID:       RHSA-2013:1784-01
Product:           Red Hat JBoss Enterprise Application Platform
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2013-1784.html
Issue date:        2013-12-04
CVE Names:         CVE-2013-2035 CVE-2013-2133 
=====================================================================

1. Summary:

An update for Red Hat JBoss Enterprise Application Platform 6.2.0, which
fixes two security issues, several bugs, and adds various enhancements, is
now available from the Red Hat Customer Portal.

The Red Hat Security Response Team has rated this update as having low
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Description:

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java
applications based on JBoss Application Server 7.

The HawtJNI Library class wrote native libraries to a predictable file name
in /tmp/ when the native libraries were bundled in a JAR file, and no
custom library path was specified. A local attacker could overwrite these
native libraries with malicious versions during the window between when
HawtJNI writes them and when they are executed. (CVE-2013-2035)

A flaw was found in the way method-level authorization for JAX-WS Service
endpoints was performed by the EJB invocation handler implementation.
Any restrictions declared on EJB methods were ignored when executing the
JAX-WS handlers, and only class-level restrictions were applied. A remote
attacker who is authorized to access the EJB class, could invoke a JAX-WS
handler which they were not authorized to invoke. (CVE-2013-2133)

The CVE-2013-2035 issue was discovered by Florian Weimer of the Red Hat
Product Security Team, and the CVE-2013-2133 issue was discovered by
Richard Opalka and Arun Neelicattu of Red Hat.

This release serves as a replacement for JBoss Enterprise Application
Platform 6.1.1, and includes bug fixes and enhancements. Documentation for
these changes will be available shortly from the JBoss Enterprise
Application Platform 6.2.0 Release Notes, linked to in the References.

All users of Red Hat JBoss Enterprise Application Platform 6.2.0 as
provided from the Red Hat Customer Portal are advised to apply this update.
The JBoss server process must be restarted for the update to take effect.

3. Solution:

The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing Red Hat JBoss Enterprise Application Platform installation and
deployed applications.

For more details, refer to the JBoss Enterprise Application Platform 6.2.0
Release Notes, linked to in the References.

4. Bugs fixed (https://bugzilla.redhat.com/):

958618 - CVE-2013-2035 HawtJNI: predictable temporary file name leading to local arbitrary code execution
969924 - CVE-2013-2133 JBoss WS: EJB3 role restrictions are not applied to jaxws handlers

5. References:

https://www.redhat.com/security/data/cve/CVE-2013-2035.html
https://www.redhat.com/security/data/cve/CVE-2013-2133.html
https://access.redhat.com/security/updates/classification/#low
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=distributions
https://access.redhat.com/site/documentation/en-US/JBoss_Enterprise_Application_Platform/6.2/html/6.2.0_Release_Notes/index.html

6. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2013 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFSn3VSXlSAg2UNWIIRAhmjAJ9jXgWDZMgadVk5EmNX/vFKpEkF8ACfU0j7
VxPsmI/8L4QmI6us9Xxkn9M=
=p37K
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC