RHSA-2013:0833: Important: JBoss Enterprise Application Platform 6.1.0 update

JBoss Enterprise Application Platform 6 is a platform for Java applicationsbased on JBoss Application Server 7.This release serves as a replacement for JBoss Enterprise ApplicationPlatform 6.0.1, and includes bug fixes and enhancements. Refer to the 6.1.0Release Notes for information on the most significant of these changes,available shortly from https://access.redhat.com/site/documentation/ Security fixes:XML encryption backwards compatibility attacks were found against variousframeworks, including Apache CXF. An attacker could force a server to useinsecure, legacy cryptosystems, even when secure cryptosystems were enabledon endpoints. By forcing the use of legacy cryptosystems, flaws such asCVE-2011-1096 and CVE-2011-2487 would be exposed, allowing plain text to berecovered from cryptograms and symmetric keys. (CVE-2012-5575)Note: Automatic checks to prevent CVE-2012-5575 are only run whenWS-SecurityPolicy is used to enforce security requirements. It is bestpractice to use WS-SecurityPolicy to enforce security requirements.A NULL pointer dereference flaw was found in the OCSP response verificationin OpenSSL. A malicious OCSP server could use this flaw to crashapplications performing OCSP verification by sending a specially-craftedresponse. (CVE-2013-0166)It was discovered that OpenSSL leaked timing information when decryptingTLS/SSL and DTLS protocol encrypted records when CBC-mode cipher suiteswere used. A remote attacker could possibly use this flaw to retrieve plaintext from the encrypted packets by using a TLS/SSL or DTLS server as apadding oracle. (CVE-2013-0169)When applications running on JBoss Web used the COOKIE session trackingmethod, the org.apache.catalina.connector.Response.encodeURL() methodreturned the URL with the jsessionid appended as a query string parameterwhen processing the first request of a session. An attacker could possiblyexploit this flaw by performing a man-in-the-middle attack to obtain auser's jsessionid and hijack their session, or by extracting the jsessionidfrom log files. Note that no session tracking method is used by default,one must be configured. (CVE-2012-4529)If multiple applications used the same custom authorization module classname, and provided their own implementations of it, the first applicationto be loaded will have its implementation used for all other applicationsusing the same custom authorization module class name. A local attackercould use this flaw to deploy a malicious application that providesimplementations of custom authorization modules that permit or deny useraccess according to rules supplied by the attacker. (CVE-2012-4572)The GUI installer created a world-readable auto-install XML file containingboth the JBoss Enterprise Application Platform administrator password andthe sucker password for the selected messaging system in plain text. Alocal user able to access the directory where the GUI installer was runcould use this flaw to gain administrative access to the JBoss EnterpriseApplication Platform instance. (CVE-2013-0218)Red Hat would like to thank Tibor Jager, Kenneth G. Paterson and JurajSomorovsky of Ruhr-University Bochum for reporting CVE-2012-5575.CVE-2012-4572 was discovered by Josef Cacek of the Red Hat JBoss EAPQuality Engineering team, and CVE-2013-0218 was discovered by ArunNeelicattu of the Red Hat Security Response Team.Warning: Before applying this update, back up your existing JBossEnterprise Application Platform installation and deployed applications.Users of JBoss Enterprise Application Platform 6.0.1 as provided from theRed Hat Customer Portal are advised to upgrade to JBoss EnterpriseApplication Platform 6.1.0.