Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2012.0905 Important: JBoss Enterprise SOA Platform 4.2.0.CP05 and 4.3.0.CP05 update 20 September 2012 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: JBoss Enterprise SOA Platform Publisher: Red Hat Operating System: Red Hat Impact/Access: Modify Arbitrary Files -- Remote/Unauthenticated Delete Arbitrary Files -- Remote/Unauthenticated Unauthorised Access -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2011-4605 Reference: ESB-2012.0841 ESB-2012.0718 ESB-2012.0695 ESB-2012.0605 ESB-2012.0596 ESB-2012.0595 Original Bulletin: https://rhn.redhat.com/errata/RHSA-2012-1295.html - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: JBoss Enterprise SOA Platform 4.2.0.CP05 and 4.3.0.CP05 update Advisory ID: RHSA-2012:1295-01 Product: JBoss Enterprise Middleware Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-1295.html Issue date: 2012-09-19 CVE Names: CVE-2011-4605 ===================================================================== 1. Summary: An update for JBoss Enterprise SOA Platform 4.2.0.CP05 and 4.3.0.CP05 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Description: JBoss Enterprise SOA Platform is the next-generation ESB and business process automation infrastructure. JBoss Enterprise SOA Platform allows IT to leverage existing (MoM and EAI), modern (SOA and BPM-Rules), and future (EDA and CEP) integration methodologies to dramatically improve business process execution speed and quality. The Java Naming and Directory Interface (JNDI) Java API allows Java software clients to locate objects or services in an application server. It was found that the JBoss JNDI service allowed unauthenticated, remote write access by default. The JNDI and HA-JNDI services, and the HAJNDIFactory invoker servlet were all affected. A remote attacker able to access the JNDI service (port 1099), HA-JNDI service (port 1100), or the HAJNDIFactory invoker servlet on a JBoss server could use this flaw to add, delete, and modify items in the JNDI tree. This could have various, application-specific impacts. (CVE-2011-4605) Red Hat would like to thank Christian Schlüter (VIADA) for reporting this issue. All users of JBoss Enterprise SOA Platform 4.2.0.CP05 and 4.3.0.CP05 as provided from the Red Hat Customer Portal are advised to apply this update. 3. Solution: The References section of this erratum contains download links (you must log in to download the update). Before applying the update, back up your existing JBoss Enterprise SOA Platform installation (including its databases, applications, configuration files, and so on). Note that it is recommended to halt the JBoss Enterprise SOA Platform server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the JBoss Enterprise SOA Platform server by starting the JBoss Application Server process. 4. Bugs fixed (http://bugzilla.redhat.com/): 766469 - CVE-2011-4605 JNDI: unauthenticated remote write access is permitted by default 5. References: https://www.redhat.com/security/data/cve/CVE-2011-4605.html https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform&downloadType=securityPatches&version=4.3.0.GA_CP05 https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches&product=soaplatform&version=4.2.0.GA_CP05 6. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2012 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFQWguzXlSAg2UNWIIRAl3TAJ9aMbLdSZ5GWNnRwXu8b8rVnWNGMQCghLvf tOaHFOVaRyMdnYaY0HTcelk= =J3YL - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBUFqgxe4yVqjM2NGpAQLfAw/+PYqO2ZJSFD+sAvKJtVVeDri4JGAGaD7b ztdPBe1RmzR/sdtH4J1crPlIXUSwNY2LzwNDdsM+T1HI3FsABbA7ghwwkuYdIACW qfCzdqHqpkyMe/ZLLuL72d4CW/jrODWJGXakGk1xEjROXm5uwpQ/Avh3YCHXkHj6 BeDko9bAl0BrNR9NzJTe5ng3uNlbFNAmcrP9v/b774km1MZ6RpJIQxqf8dsr03dW fQCa9i9kJkzQ3hUNM4JHMgFpAFeWsdIamu+ONHpLKNAx/1uxdl+7Vg32t+Eh1TCx HuQQW6axcQipIIlzN3/qUH6JSJRr8WnV8IXsSImYn7g9c9jKAnhlW6epOlQohr01 tdEw0z/TrSJXweti3IcIgUmgJyhC+pJZHKNFCj17Egqr7fHTzttWzJ5/c0sb4Jdk lRedJe3p8Pmb5PrTSCbMAX9bAyyYQ0hUTPXzpDajXDYET5MvmeQFXQnPBCPmVGPm Sg2uXnx+aMdVrJlgNgNB0AV8ne7ySrUtaJ5j+goF5TFYr3MXd9vueSUYkp9x/9Re m+S2oqeQhFEPldZ+PX7QTOw38O7kzazd0SVDo782KDiOMiXU7ubJ8q6CSr747oar mMAAWQLBtnQVYT2ACKCmqv6kCgTR4ww+5JWMRBV6bw2uaBU86S9cqIvHViQXI2kV SIhOSwWM0VM= =XV/a -----END PGP SIGNATURE-----