RHSA-2012:0075: Important: jbossweb security update

JBoss Web is the web container, based on Apache Tomcat, in JBoss EnterpriseApplication Platform. It provides a single deployment platform for theJavaServer Pages (JSP) and Java Servlet technologies.A flaw was found in the way JBoss Web handled UTF-8 surrogate paircharacters. If JBoss Web was hosting an application with UTF-8 characterencoding enabled, or that included user-supplied UTF-8 strings in aresponse, a remote attacker could use this flaw to cause a denial ofservice (infinite loop) on the JBoss Web server. (CVE-2011-4610)It was found that the Java hashCode() method implementation wassusceptible to predictable hash collisions. A remote attacker could usethis flaw to cause JBoss Web to use an excessive amount of CPU time bysending an HTTP request with a large number of parameters whose names mapto the same hash value. This update introduces a limit on the number ofparameters and headers processed per request to mitigate this issue. Thedefault limit is 512 for parameters and 128 for headers. These defaultscan be changed by setting theorg.apache.tomcat.util.http.Parameters.MAXCOUNT andorg.apache.tomcat.util.http.MimeHeaders.MAXCOUNT system properties in"jboss-as/server/[PROFILE]/deploy/properties-service.xml". (CVE-2011-4858)It was found that JBoss Web did not handle large numbers of parameters andlarge parameter values efficiently. A remote attacker could make a JBossWeb server use an excessive amount of CPU time by sending an HTTP requestcontaining a large number of parameters or large parameter values. Thisupdate introduces limits on the number of parameters and headers processedper request to address this issue. Refer to the CVE-2011-4858 descriptionfor information about the org.apache.tomcat.util.http.Parameters.MAXCOUNTand org.apache.tomcat.util.http.MimeHeaders.MAXCOUNT system properties.(CVE-2012-0022)Multiple flaws were found in the way JBoss Web handled HTTP DIGESTauthentication. These flaws weakened the JBoss Web HTTP DIGESTauthentication implementation, subjecting it to some of the weaknesses ofHTTP BASIC authentication, for example, allowing remote attackers toperform session replay attacks. (CVE-2011-1184, CVE-2011-5062,CVE-2011-5063, CVE-2011-5064)A flaw was found in the way JBoss Web handled sendfile request attributeswhen using the HTTP APR (Apache Portable Runtime) or NIO (Non-Blocking I/O)connector. A malicious web application running on a JBoss Web instancecould use this flaw to bypass security manager restrictions and gain accessto files it would otherwise be unable to access, or possibly terminate theJava Virtual Machine (JVM). (CVE-2011-2526)Red Hat would like to thank NTT OSSC for reporting CVE-2011-4610; oCERT forreporting CVE-2011-4858; and the Apache Tomcat project for reportingCVE-2011-2526. oCERT acknowledges Julian Wälde and Alexander Klink as theoriginal reporters of CVE-2011-4858.Warning: Before applying this update, back up your JBoss EnterpriseApplication Platform's "jboss-as/server/[PROFILE]/deploy/" directory, alongwith all other customized configuration files.All users of JBoss Enterprise Application Platform 5.1.2 as provided fromthe Red Hat Customer Portal are advised to install this update.