RHSA-2010:0379: Critical: JBoss Enterprise Application Platform 4.3.0.CP08 update

JBoss Enterprise Application Platform is the market leading platform forinnovative and scalable Java applications; integrating the JBossApplication Server, with JBoss Hibernate and JBoss Seam into a complete,simple enterprise solution.This release of JBEAP for Red Hat Enterprise Linux 5 serves as areplacement to JBEAP 4.3.0.CP07.These updated packages include multiple bug fixes which are detailed in theRelease Notes. The Release Notes will be available shortly from the linkin the References section.The following security issues are also fixed with this release:The JMX Console configuration only specified an authentication requirementfor requests that used the GET and POST HTTP "verbs". A remote attackercould create an HTTP request that does not specify GET or POST, causing itto be executed by the default GET handler without authentication. Thisrelease contains a JMX Console with an updated configuration that no longerspecifies the HTTP verbs. This means that the authentication requirement isapplied to all requests. (CVE-2010-0738)For the CVE-2010-0738 issue, if an immediate upgrade is not possible or theserver deployment has been customized, a manual fix can be applied. Referto the "Security" subsection of the "Issues fixed in this release" section(JBPAPP-3952) of the JBEAP Release Notes, linked to in the References, fordetails. Contact Red Hat JBoss Support for advice before making the changesnoted in the Release Notes.Red Hat would like to thank Stefano Di Paola and Giorgio Fedon of MindedSecurity for responsibly reporting the CVE-2010-0738 issue.Unauthenticated access to the JBoss Application Server Web Console(/web-console) is blocked by default. However, it was found that this blockwas incomplete, and only blocked GET and POST HTTP verbs. A remote attackercould use this flaw to gain access to sensitive information. This releasecontains a Web Console with an updated configuration that now blocks allunauthenticated access to it by default. (CVE-2010-1428)The RHSA-2008:0828 update fixed an issue (CVE-2008-3273) whereunauthenticated users were able to access the status servlet; however, abug fix included in the RHSA-2009:0349 update re-introduced the issue. Aremote attacker could use this flaw to acquire details about deployed webcontexts. (CVE-2010-1429)Warning: Before applying this update, please backup the JBEAP"server/[configuration]/deploy/" directory, and any other customizedconfiguration files.All users of JBEAP 4.3 on Red Hat Enterprise Linux 5 are advised to upgradeto these updated packages.