Security Advisory Critical: jboss-seam2 security update

Advisory: RHSA-2013:1044-1
Type: Security Advisory
Severity: Critical
Issued on: 2013-07-10
Last updated on: 2013-07-10
Affected Products: JBoss Enterprise Application Platform 4.3.0 EL4
JBoss Enterprise Application Platform 4.3.0 EL5
CVEs (cve.mitre.org): CVE-2013-2165

Details

Updated jboss-seam2 packages that fix one security issue are now available
for Red Hat JBoss Enterprise Application Platform 4.3.0 CP10 for Red Hat
Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having critical
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

The JBoss Seam 2 framework is an application framework for building web
applications in Java. The RichFaces component is an open source framework
that adds Ajax capability into existing JavaServer Faces (JSF)
applications.

A flaw was found in the way RichFaces ResourceBuilderImpl handled
deserialization. A remote attacker could use this flaw to trigger the
execution of the deserialization methods in any serializable class deployed
on the server. This could lead to a variety of security impacts depending
on the deserialization logic of these classes. (CVE-2013-2165)

The fix for this issue introduces a whitelist to limit classes that can be
deserialized by RichFaces.

If you require to whitelist a class that is not already listed, for
example, a custom class, you can achieve this by following one of these
methods:

Method 1: Implementing the SerializableResource interface.
In RichFaces 3, this is defined at
org.ajax4jsf.resource.SerializableResource and in RichFaces 4/5, at
org.richfaces.resource.SerializableResource.

Method 2: Adding the class to the resource-serialization.properties file
(a default properties file is provided once this update is applied).
To do this you can extend the framework provided properties file that is
available under org.ajax4jsf.resource in RichFaces 3 and
org.richfaces.resource in RichFaces 4/5. The modified properties file has
to be copied into the classpath of your deployment under the
version-specific packages.

Where possible, it is recommended that Method 1 be followed.

Red Hat would like to thank Takeshi Terada (Mitsui Bussan Secure
Directions, Inc.) for reporting this issue.

Warning: Before applying this update, back up your existing Red Hat JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of Red Hat JBoss Enterprise Application Platform 4.3.0 CP10 on
Red Hat Enterprise Linux 4 and 5 are advised to upgrade to these updated
packages. The JBoss server process must be restarted for the update to take
effect.


Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Updated packages

JBoss Enterprise Application Platform 4.3.0 EL4

SRPMS:
jboss-seam2-2.0.2.FP_SEC1-1.ep2.6.el4.src.rpm
File outdated by:  RHBA-2013:1099
    MD5: dd139ed40cd19155f5a5c5ef2f3b8cd7
SHA-256: b6a21daeaaf608dece95b4369d0e2e09db64346f1528152313cdcb1421d79697
 
IA-32:
jboss-seam2-2.0.2.FP_SEC1-1.ep2.6.el4.noarch.rpm
File outdated by:  RHBA-2013:1099
    MD5: 6c82e7b1ed75a8b6693f38fabe10515b
SHA-256: 677b802619e4fd0103ad62e1a21537cb26ca0932b751c7c195a1d45a8e515cf9
jboss-seam2-docs-2.0.2.FP_SEC1-1.ep2.6.el4.noarch.rpm
File outdated by:  RHBA-2013:1099
    MD5: 6b4a93cca8c1c793573c08d61e6bed21
SHA-256: 8dc2d47e5a3a80fefe3d1847df998a38108d10c1f04e64032ce402e3b41e7d5c
 
x86_64:
jboss-seam2-2.0.2.FP_SEC1-1.ep2.6.el4.noarch.rpm
File outdated by:  RHBA-2013:1099
    MD5: 6c82e7b1ed75a8b6693f38fabe10515b
SHA-256: 677b802619e4fd0103ad62e1a21537cb26ca0932b751c7c195a1d45a8e515cf9
jboss-seam2-docs-2.0.2.FP_SEC1-1.ep2.6.el4.noarch.rpm
File outdated by:  RHBA-2013:1099
    MD5: 6b4a93cca8c1c793573c08d61e6bed21
SHA-256: 8dc2d47e5a3a80fefe3d1847df998a38108d10c1f04e64032ce402e3b41e7d5c
 
JBoss Enterprise Application Platform 4.3.0 EL5

IA-32:
jboss-seam2-2.0.2.FP_SEC1-1.ep2.6.el5.noarch.rpm
File outdated by:  RHBA-2013:1099
    MD5: b338607f832e654378cde28e17a2a71c
SHA-256: 184f3e7bb39672b444d73f3fe6fad667d471090b0e5928fde4ea0f9d39c6e2a1
jboss-seam2-docs-2.0.2.FP_SEC1-1.ep2.6.el5.noarch.rpm
File outdated by:  RHBA-2013:1099
    MD5: 3843b3c806174014d9c5a7950b1e47de
SHA-256: 25c72936e9b8181f3307222f766f50654507bb1f6a6af7ddbe363a06bc487123
 
x86_64:
jboss-seam2-2.0.2.FP_SEC1-1.ep2.6.el5.noarch.rpm
File outdated by:  RHBA-2013:1099
    MD5: b338607f832e654378cde28e17a2a71c
SHA-256: 184f3e7bb39672b444d73f3fe6fad667d471090b0e5928fde4ea0f9d39c6e2a1
jboss-seam2-docs-2.0.2.FP_SEC1-1.ep2.6.el5.noarch.rpm
File outdated by:  RHBA-2013:1099
    MD5: 3843b3c806174014d9c5a7950b1e47de
SHA-256: 25c72936e9b8181f3307222f766f50654507bb1f6a6af7ddbe363a06bc487123
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

973570 - CVE-2013-2165 JBoss RichFaces: Remote code execution due to insecure deserialization


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/