From bugzilla at redhat.com Thu Nov 21 18:45:56 2013 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 21 Nov 2013 18:45:56 +0000 Subject: [RHSA-2013:1757-01] Important: JBoss Web Services security update Message-ID: <201311211845.rALIjupt010630@int-mx10.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: JBoss Web Services security update Advisory ID: RHSA-2013:1757-01 Product: Red Hat JBoss Middleware Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-1757.html Issue date: 2013-11-21 CVE Names: CVE-2011-2487 ===================================================================== 1. Summary: An update for the JBoss Web Services component in Red Hat JBoss SOA Platform 4.3 CP05 and Red Hat JBoss Portal 4.3 CP07, which fixes one security issue, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Description: Red Hat JBoss SOA Platform is the next-generation ESB and business process automation infrastructure. Red Hat JBoss Portal is the open source implementation of the Java EE suite of services and Portal services running atop Red Hat JBoss Enterprise Application Platform. JBoss Web Services leaked side-channel data when distributing symmetric keys (for XML encryption), allowing a remote attacker to recover the entire plain text form of a symmetric key. (CVE-2011-2487) Red Hat would like to thank Juraj Somorovsky of Ruhr-University Bochum for reporting this issue. Warning: Before applying this update, back up your JBoss installation, including any databases, database settings, applications, configuration files, and so on. All users of Red Hat JBoss SOA Platform 4.3 CP05 and Red Hat JBoss Portal 4.3 CP07 as provided from the Red Hat Customer Portal are advised to apply this update. 3. Solution: The References section of this erratum contains download links (you must log in to download the update). Before applying this update, back up your JBoss installation, including any databases, database settings, applications, configuration files, and so on. For both Red Hat JBoss SOA Platform and Red Hat JBoss Portal, it is recommended to halt the server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the server by starting the JBoss Application Server process. 4. Bugs fixed (https://bugzilla.redhat.com/): 713539 - CVE-2011-2487 jbossws: Prone to Bleichenbacher attack against to be distributed symmetric key 5. References: https://www.redhat.com/security/data/cve/CVE-2011-2487.html https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform&downloadType=securityPatches&version=4.3.0.GA_CP05 https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal&downloadType=securityPatches&version=4.3+CP07 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2013 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFSjlMpXlSAg2UNWIIRAl7oAJ4oSPeYxYPSMI/+aal9WOwhPjfFIACfXMq7 gPI8f1Soxkfm2hef51tmgjo= =TlfV -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Nov 25 19:07:38 2013 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 25 Nov 2013 19:07:38 +0000 Subject: [RHSA-2013:1762-01] Moderate: Red Hat JBoss Operations Network 3.1.2 update Message-ID: <201311251907.rAPJ7cJa025580@int-mx09.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Operations Network 3.1.2 update Advisory ID: RHSA-2013:1762-01 Product: Red Hat JBoss Operations Network Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-1762.html Issue date: 2013-11-25 CVE Names: CVE-2013-4452 ===================================================================== 1. Summary: An update for Red Hat JBoss Operations Network 3.1.2 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Description: Red Hat JBoss Operations Network is a middleware management solution that provides a single point of control to deploy, manage, and monitor JBoss Enterprise Middleware, applications, and services. It was discovered that the JBoss Operation Network configuration files, for both the server and the agent, were world readable by default. A malicious local user could possibly read sensitive information regarding the installation, including various authentication credentials. (CVE-2013-4452) This issue was discovered by Larry O'Leary of the Red Hat Middleware Support Engineering Group. All users of JBoss Operations Network 3.1.2 as provided from the Red Hat Customer Portal are advised to apply this update. 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing JBoss Operations Network installation (including its databases, applications, configuration files, the JBoss Operations Network server's file system directory, and so on). To apply the fix for CVE-2013-4452 to an existing server or agent, for which you do not want to use the default patched files distributed by this update, using the chmod utility, remove the read file permission attribute from the following files (where it exists): /bin/rhq-server.properties /conf/agent-configuration.xml ~/.java/.userPrefs/rhq-agent/default/prefs.xml Note: This update provides fixes for the server and agent components of Red Hat JBoss Operations Network. It is recommended to apply all the patches provided by this update. Refer to the JBoss Operations Network 3.1.2 Release Notes for installation information. 4. Bugs fixed (https://bugzilla.redhat.com/): 1021756 - CVE-2013-4452 JBoss ON: World readable configuration files expose sensitive data 5. References: https://www.redhat.com/security/data/cve/CVE-2013-4452.html https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em&downloadType=securityPatches&version=3.1.2 https://access.redhat.com/site/documentation/Red_Hat_JBoss_Operations_Network/ 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2013 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFSk5++XlSAg2UNWIIRAlgCAJ9q+1UOuFwObtNAzP8ZIUsIv5ASggCdEHxO 092sQTN/mi3Zn7Vszrl4Lfk= =NgQD -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 27 17:12:00 2013 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 27 Nov 2013 17:12:00 +0000 Subject: [RHSA-2013:1771-01] Low: Red Hat JBoss Web Framework Kit 2.4.0 update Message-ID: <201311271712.rARHC0Yq031881@int-mx09.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Low: Red Hat JBoss Web Framework Kit 2.4.0 update Advisory ID: RHSA-2013:1771-01 Product: Red Hat JBoss Web Framework Kit Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-1771.html Issue date: 2013-11-27 CVE Names: CVE-2013-4112 ===================================================================== 1. Summary: Red Hat JBoss Web Framework Kit 2.4.0, which fixes one security issue, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Description: Red Hat JBoss Web Framework Kit combines popular open source web frameworks into a single solution for Java applications. This release serves as a replacement for Red Hat JBoss Web Framework Kit 2.3.0, and includes bug fixes and enhancements. Refer to the 2.4.0 Release Notes for information on the most significant of these changes, available shortly from https://access.redhat.com/site/documentation/ This release also fixes the following security issue: A flaw was found in JGroup's DiagnosticsHandler that allowed an attacker on an adjacent network to reuse the credentials from a previous successful authentication. This could be exploited to read diagnostic information (information disclosure) and attain limited remote code execution. (CVE-2013-4112) All users of Red Hat JBoss Web Framework Kit 2.3.0 as provided from the Red Hat Customer Portal are advised to upgrade to Red Hat JBoss Web Framework Kit 2.4.0. 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing installation of Red Hat JBoss Enterprise Application Platform or Red Hat JBoss Web Server, and applications deployed to it. The JBoss server process must be restarted for this update to take effect. 4. Bugs fixed (https://bugzilla.redhat.com/): 983489 - CVE-2013-4112 JGroups: Authentication via cached credentials 5. References: https://www.redhat.com/security/data/cve/CVE-2013-4112.html https://access.redhat.com/security/updates/classification/#low https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=web.framework.kit&downloadType=distributions https://access.redhat.com/site/documentation/Red_Hat_JBoss_Web_Framework_Kit/ 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2013 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFSlifPXlSAg2UNWIIRAgxjAKCxDbqWuewetZn9Chv/DQXT9bGjAwCfVxfr liocUrmbZdJvbpcuEf3QfFM= =582i -----END PGP SIGNATURE-----