RHSA-2010:0379: Critical: JBoss Enterprise Application Platform 4.3.0.CP08 update

First published: Tue Apr 27 2010(Updated: )

JBoss Enterprise Application Platform is the market leading platform for<br>innovative and scalable Java applications; integrating the JBoss<br>Application Server, with JBoss Hibernate and JBoss Seam into a complete,<br>simple enterprise solution.<br>This release of JBEAP for Red Hat Enterprise Linux 5 serves as a<br>replacement to JBEAP 4.3.0.CP07.<br>These updated packages include multiple bug fixes which are detailed in the<br>Release Notes. The Release Notes will be available shortly from the link<br>in the References section.<br>The following security issues are also fixed with this release:<br>The JMX Console configuration only specified an authentication requirement<br>for requests that used the GET and POST HTTP "verbs". A remote attacker<br>could create an HTTP request that does not specify GET or POST, causing it<br>to be executed by the default GET handler without authentication. This<br>release contains a JMX Console with an updated configuration that no longer<br>specifies the HTTP verbs. This means that the authentication requirement is<br>applied to all requests. (CVE-2010-0738)<br>For the CVE-2010-0738 issue, if an immediate upgrade is not possible or the<br>server deployment has been customized, a manual fix can be applied. Refer<br>to the "Security" subsection of the "Issues fixed in this release" section<br>(JBPAPP-3952) of the JBEAP Release Notes, linked to in the References, for<br>details. Contact Red Hat JBoss Support for advice before making the changes<br>noted in the Release Notes.<br>Red Hat would like to thank Stefano Di Paola and Giorgio Fedon of Minded<br>Security for responsibly reporting the CVE-2010-0738 issue.<br>Unauthenticated access to the JBoss Application Server Web Console<br>(/web-console) is blocked by default. However, it was found that this block<br>was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker<br>could use this flaw to gain access to sensitive information. This release<br>contains a Web Console with an updated configuration that now blocks all<br>unauthenticated access to it by default. (CVE-2010-1428)<br>The RHSA-2008:0828 update fixed an issue (CVE-2008-3273) where<br>unauthenticated users were able to access the status servlet; however, a<br>bug fix included in the RHSA-2009:0349 update re-introduced the issue. A<br>remote attacker could use this flaw to acquire details about deployed web<br>contexts. (CVE-2010-1429)<br>Warning: Before applying this update, please backup the JBEAP<br>"server/[configuration]/deploy/" directory, and any other customized<br>configuration files.<br>All users of JBEAP 4.3 on Red Hat Enterprise Linux 5 are advised to upgrade<br>to these updated packages.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-errata
• anchor-id/RHSA-2010:0379
• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• package-manager/redhat