Red Hat Customer Portal

Skip to main content

Security Advisory Important: Red Hat JBoss Enterprise Application Platform 6.4.0 update

Advisory: RHSA-2015:0849-1
Type: Security Advisory
Severity: Important
Issued on: 2015-04-16
Last updated on: 2015-04-16
Affected Products:
CVEs (cve.mitre.org): CVE-2014-3570
CVE-2014-3586
CVE-2014-8111
CVE-2015-0204
CVE-2015-0226
CVE-2015-0227
CVE-2015-0277

Details

Updated packages that provide Red Hat JBoss Enterprise Application Platform
6.4.0, and fix multiple security issues, several bugs, and add various
enhancements, are now available from the Red Hat Customer Portal.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java
applications based on JBoss Application Server 7.

It was found that a prior countermeasure in Apache WSS4J for
Bleichenbacher's attack on XML Encryption (CVE-2011-2487) threw an
exception that permitted an attacker to determine the failure of the
attempted attack, thereby leaving WSS4J vulnerable to the attack.
The original flaw allowed a remote attacker to recover the entire plain
text form of a symmetric key. (CVE-2015-0226)

A flaw was found in the way PicketLink's Service Provider and Identity
Provider handled certain requests. A remote attacker could use this flaw to
log to a victim's account via PicketLink. (CVE-2015-0277)

It was discovered that a JkUnmount rule for a subtree of a previous JkMount
rule could be ignored. This could allow a remote attacker to potentially
access a private artifact in a tree that would otherwise not be accessible
to them. (CVE-2014-8111)

It was discovered that OpenSSL would accept ephemeral RSA keys when using
non-export RSA cipher suites. A malicious server could make a TLS/SSL
client using OpenSSL use a weaker key exchange method. (CVE-2015-0204)

It was found that Apache WSS4J permitted bypass of the
requireSignedEncryptedDataElements configuration property via XML Signature
wrapping attacks. A remote attacker could use this flaw to modify the
contents of a signed request. (CVE-2015-0227)

It was found that OpenSSL's BigNumber Squaring implementation could produce
incorrect results under certain special conditions. This flaw could
possibly affect certain OpenSSL library functionality, such as RSA
blinding. Note that this issue occurred rarely and with a low probability,
and there is currently no known way of exploiting it. (CVE-2014-3570)

It was found that the Command Line Interface, as provided by Red Hat
Enterprise Application Platform, created a history file named
.jboss-cli-history in the user's home directory with insecure default file
permissions. This could allow a malicious local user to gain information
otherwise not accessible to them. (CVE-2014-3586)

The CVE-2015-0277 issue was discovered by Ondrej Kotek of Red Hat.

This release of JBoss Enterprise Application Platform also includes bug
fixes and enhancements. Documentation for these changes will be available
shortly from the JBoss Enterprise Application Platform 6.4.0 Release Notes,
linked to in the References.

All users of Red Hat JBoss Enterprise Application Platform 6.3 as provided
from the Red Hat Customer Portal are advised to apply this update.
The JBoss server process must be restarted for the update to take effect.


Solution

The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing Red Hat JBoss Enterprise Application Platform installation and
deployed applications.

Updated packages


Bugs fixed (see bugzilla for more information)

1126687 - CVE-2014-3586 JBoss AS CLI: Insecure default permissions on history file
1180184 - CVE-2015-0204 openssl: only allow ephemeral RSA keys in export ciphersuites (FREAK)
1180240 - CVE-2014-3570 openssl: Bignum squaring may produce incorrect results
1182591 - CVE-2014-8111 Tomcat mod_jk: information leak due to incorrect JkMount/JkUnmount directives processing
1191446 - CVE-2015-0226 wss4j: Apache WSS4J is vulnerable to Bleichenbacher's attack (incomplete fix for CVE-2011-2487)
1191451 - CVE-2015-0227 wss4j: Apache WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements property
1194832 - CVE-2015-0277 PicketLink: SP does not take Audience condition of a SAML assertion into account


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/