RHSA-2010:0119: Low: JBoss Enterprise Web Server 1.0.1 update

First published: Tue Feb 23 2010(Updated: )

JBoss Enterprise Web Server is a fully integrated and certified set<br>of components for hosting Java web applications. It is comprised of the<br>industry's leading web server (Apache HTTP Server), the popular Apache<br>Tomcat servlet container, as well as the mod_jk connector and the Tomcat<br>Native library.<br>This 1.0.1 release of JBoss Enterprise Web Server serves as a replacement<br>to JBoss Enterprise Web Server 1.0.0 GA. These updated packages include<br>a number of bug fixes. For detailed component, installation, and bug fix<br>information, refer to the JBoss Enterprise Web Server 1.0.1 Release Notes,<br>available shortly from the link in the References section of this erratum.<br>The following security issues are also fixed with this release:<br>A directory traversal flaw was found in the Tomcat deployment process. An<br>attacker could create a specially-crafted WAR file, which once deployed<br>by a local, unsuspecting user, would lead to attacker-controlled content<br>being deployed outside of the web root, into directories accessible to the<br>Tomcat process. (CVE-2009-2693)<br>A second directory traversal flaw was found in the Tomcat deployment<br>process. WAR file names were not sanitized, which could allow an attacker<br>to create a specially-crafted WAR file that could delete files in the<br>Tomcat host's work directory. (CVE-2009-2902)<br>A flaw was found in the way the TLS/SSL (Transport Layer Security/Secure<br>Sockets Layer) protocols handle session renegotiation. A man-in-the-middle<br>attacker could use this flaw to prefix arbitrary plain text to a client's<br>session (for example, an HTTPS connection to a website). This could force<br>the server to process an attacker's request as if authenticated using the<br>victim's credentials. (CVE-2009-3555)<br>This update provides a mitigation for this flaw in the following<br>components:<br>tomcat5 and tomcat6: A new attribute, allowUnsafeLegacyRenegotiation, is<br>available for the blocking IO (BIO) connector using JSSE, to enable or<br>disable TLS session renegotiation. The default value is "false", meaning<br>session renegotiation, both client- and server-initiated, is disabled by<br>default.<br>tomcat-native: Client-initiated renegotiation is now rejected by the native<br>connector. Server-initiated renegotiation is still allowed.<br>Refer to the following Knowledgebase article for additional details about<br>the CVE-2009-3555 flaw: <a href="http://kbase.redhat.com/faq/docs/DOC-20491" target="_blank">http://kbase.redhat.com/faq/docs/DOC-20491</a> All users of JBoss Enterprise Web Server 1.0.0 on Red Hat Enterprise Linux<br>4 and 5 are advised to upgrade to these updated packages.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2010:0119
• agent/software-canonical-lookup
• package-manager/redhat