RHSA-2009:1649: Moderate: JBoss Enterprise Application Platform 4.3.0.CP07 update

First published: Wed Dec 09 2009(Updated: )

JBoss Enterprise Application Platform is the market leading platform for<br>innovative and scalable Java applications; integrating the JBoss<br>Application Server, with JBoss Hibernate and JBoss Seam into a complete,<br>simple enterprise solution.<br>This release of JBEAP for Red Hat Enterprise Linux 5 serves as a<br>replacement to JBEAP 4.3.0.CP06.<br>These updated packages include bug fixes and enhancements which are<br>detailed in the Release Notes, available shortly from:<br><a href="http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/" target="_blank">http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/</a> The following security issues are also fixed with this release:<br>A missing check for the recommended minimum length of the truncated form of<br>HMAC-based XML signatures was found in xml-security. An attacker could use<br>this flaw to create a specially-crafted XML file that forges an XML<br>signature, allowing the attacker to bypass authentication that is based on<br>the XML Signature specification. (CVE-2009-0217)<br>Swatej Kumar discovered cross-site scripting (XSS) flaws in the JBoss<br>Application Server Web Console. An attacker could use these flaws to<br>present misleading data to an authenticated user, or execute arbitrary<br>scripting code in the context of the authenticated user's browser session.<br>(CVE-2009-2405)<br>A flaw was found in the way the Apache Xerces2 Java Parser processed the<br>SYSTEM identifier in DTDs. A remote attacker could provide a<br>specially-crafted XML file, which once parsed by an application using the<br>Apache Xerces2 Java Parser, would lead to a denial of service (application<br>hang due to excessive CPU use). (CVE-2009-2625)<br>An information leak flaw was found in the twiddle command line client. The<br>JMX password was logged in plain text to "twiddle.log". (CVE-2009-3554)<br>An XSS flaw was found in the JMX Console. An attacker could use this flaw<br>to present misleading data to an authenticated user, or execute arbitrary<br>scripting code in the context of the authenticated user's browser session.<br>(CVE-2009-1380)<br>Warning: Before applying this update, please backup the JBEAP<br>"server/[configuration]/deploy/" directory, and any other customized<br>configuration files.<br>All users of JBEAP 4.3 on Red Hat Enterprise Linux 5 are advised to upgrade<br>to these updated packages.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2009:1649
• agent/software-canonical-lookup
• package-manager/redhat