RHSA-2013:0221: Important: JBoss Enterprise BRMS Platform 5.3.1 update

Security fixes:An attack technique against the W3C XML Encryption Standard when blockciphers were used in CBC mode could allow a remote attacker to conductchosen-ciphertext attacks, leading to the recovery of the entire plain textof a particular cryptogram. (CVE-2011-1096)JBoss Web Services leaked side-channel data when distributing symmetrickeys (for XML encryption), allowing a remote attacker to recover the entireplain text form of a symmetric key. (CVE-2011-2487)Spring framework could possibly evaluate Expression Language (EL)expressions twice, allowing a remote attacker to execute arbitrary code inthe context of the application server, or to obtain sensitive informationfrom the server. Manual action is required to apply this fix. Refer to theSolution section. (CVE-2011-2730)When an application used FORM authentication, along with another componentthat calls request.setUserPrincipal() before the call toFormAuthenticator#authenticate() (such as the Single-Sign-On valve), it waspossible to bypass the security constraint checks in the FORM authenticatorby appending "/jsecuritycheck" to the end of a URL. (CVE-2012-3546)An XSS flaw allowed a remote attacker to perform an XSS attack againstvictims using the JMX Console. (CVE-2011-4575)SecurityAssociation.getCredential() returned the previous credential if nosecurity context was provided. Depending on the deployed applications, thiscould possibly allow a remote attacker to hijack the credentials of apreviously-authenticated user. (CVE-2012-3370)Configuring the JMX Invoker to restrict access to users with specific rolesdid not actually restrict access, allowing remote attackers with valid JMXInvoker credentials to perform JMX operations accessible to roles they arenot a member of. (CVE-2012-5478)twiddle.sh accepted credentials as command line arguments, allowing localusers to view them via a process listing. (CVE-2009-5066)It was found that NonManagedConnectionFactory would log the username andpassword in plain text when an exception was thrown. This could lead to theexposure of authentication credentials if local users had permissions toread the log file. (CVE-2012-0034)The JMXInvokerHAServlet and EJBInvokerHAServlet invoker servlets allowunauthenticated access by default in some profiles. The securityinterceptor's second layer of authentication prevented direct exploitationof this flaw. If the interceptor was misconfigured or inadvertentlydisabled, this flaw could lead to arbitrary code execution in the contextof the user running the JBoss server. (CVE-2012-0874)CallerIdentityLoginModule retained the password from the previous call if anull password was provided. In non-default configurations this couldpossibly lead to a remote attacker hijacking a previously-authenticateduser's session. (CVE-2012-3369)Red Hat would like to thank Juraj Somorovsky of Ruhr-University Bochum forreporting CVE-2011-1096 and CVE-2011-2487, and Tyler Krpata for reportingCVE-2011-4575. CVE-2012-3370 and CVE-2012-3369 were discovered by Carlo deWolf of Red Hat; CVE-2012-5478 discovered by Derek Horton of Red Hat; andCVE-2012-0874 was discovered by David Jorm of the Red Hat Security ResponseTeam.