Skip to navigation

Security Advisory Important: JBoss Enterprise BRMS Platform 5.3.0 update

Advisory: RHSA-2012:1028-1
Type: Security Advisory
Severity: Important
Issued on: 2012-06-22
Last updated on: 2012-06-22
Affected Products:
CVEs (cve.mitre.org): CVE-2011-4085
CVE-2011-4605
CVE-2012-1167
CVE-2012-2377

Details

JBoss Enterprise BRMS Platform 5.3.0, which fixes multiple security issues,
various bugs, and adds enhancements is now available from the Red Hat
Customer Portal.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

JBoss Enterprise BRMS Platform is a business rules management system for
the management, storage, creation, modification, and deployment of JBoss
Rules. The Java Naming and Directory Interface (JNDI) Java API allows Java
software clients to locate objects or services in an application server.

This release of JBoss Enterprise BRMS Platform 5.3.0 serves as a
replacement for JBoss Enterprise BRMS Platform 5.2.0. It includes various
bug fixes and enhancements which are detailed in the JBoss Enterprise BRMS
Platform 5.3.0 Release Notes. The Release Notes will be available shortly
from https://docs.redhat.com/docs/en-US/index.html

The following security issues are also fixed with this release:

It was found that the JBoss JNDI service allowed unauthenticated, remote
write access by default. The JNDI and HA-JNDI services, and the
HAJNDIFactory invoker servlet were all affected. A remote attacker able to
access the JNDI service (port 1099), HA-JNDI service (port 1100), or the
HAJNDIFactory invoker servlet on a JBoss server could use this flaw to add,
delete, and modify items in the JNDI tree. This could have various,
application-specific impacts. (CVE-2011-4605)

It was found that the invoker servlets, deployed by default via
httpha-invoker, only performed access control on the HTTP GET and POST
methods, allowing remote attackers to make unauthenticated requests by
using different HTTP methods. Due to the second layer of authentication
provided by a security interceptor, this issue is not exploitable on
default installations unless an administrator has misconfigured the
security interceptor or disabled it. (CVE-2011-4085)

When a JGroups channel is started, the JGroups diagnostics service would be
enabled by default with no authentication. This service is exposed via IP
multicast. An attacker on an adjacent network could exploit this flaw to
read diagnostics information. (CVE-2012-2377)

Red Hat would like to thank Christian Schlüter (VIADA) for reporting
CVE-2011-4605.

Warning: Before applying the update, back up your existing JBoss Enterprise
BRMS Platform installation (including its databases, applications,
configuration files, and so on).

All users of JBoss Enterprise BRMS Platform 5.2.0 as provided from the Red
Hat Customer Portal are advised to upgrade to JBoss Enterprise BRMS
Platform 5.3.0.


Solution

The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing JBoss Enterprise BRMS Platform installation (including its
databases, applications, configuration files, and so on).

Updated packages


Bugs fixed (see bugzilla for more information)

750422 - CVE-2011-4085 Invoker servlets authentication bypass (HTTP verb tampering)
766469 - CVE-2011-4605 JNDI: unauthenticated remote write access is permitted by default
823392 - CVE-2012-2377 JGroups diagnostics service enabled by default with no authentication when a JGroups channel is started


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/