Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.1806
Moderate: Red Hat JBoss Portal 6.1.0 security update
17 December 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Red Hat JBoss Portal
Publisher: Red Hat
Operating System: Windows
Red Hat
Solaris
Impact/Access: Cross-site Scripting -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2013-4424
Original Bulletin:
https://rhn.redhat.com/errata/RHSA-2013-1843.html
Comment: This advisory references vulnerabilities in products which run on
platforms other than Red Hat. It is recommended that administrators
running Red Hat JBoss Portal check for an updated version of the
software for their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat JBoss Portal 6.1.0 security update
Advisory ID: RHSA-2013:1843-01
Product: Red Hat JBoss Portal
Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-1843.html
Issue date: 2013-12-16
CVE Names: CVE-2013-4424
=====================================================================
1. Summary:
An update for the GateIn Portal component in Red Hat JBoss Portal 6.1.0
that fixes one security issue is now available from the Red Hat Customer
Portal.
The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
2. Description:
Red Hat JBoss Portal is the open source implementation of the Java EE suite
of services and Portal services running atop Red Hat JBoss Enterprise
Application Platform. It comprises a set of offerings for enterprise
customers who are looking for pre-configured profiles of JBoss Middleware
components that have been tested and certified together to provide an
integrated experience.
Multiple cross-site scripting (XSS) flaws were found in the GateIn Portal
component. If a remote attacker could trick a user, who was logged into the
GateIn Portal interface, into visiting a specially crafted URL, it would
lead to arbitrary web script execution in the context of the user's GateIn
Portal session. (CVE-2013-4424)
Red Hat would like to thank Cloud Technology Development Department, Ricoh
Company, Ltd. for reporting this issue.
All users of Red Hat JBoss Portal 6.1.0 as provided from the Red Hat
Customer Portal are advised to install this update.
3. Solution:
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up all
applications deployed on Red Hat JBoss Portal, along with all customized
configuration files, and any databases and database settings.
Note that it is recommended to halt the JBoss Portal server by stopping the
JBoss Application Server process before installing this update, and then
after installing the update, restart the JBoss Portal server by starting
the JBoss Application Server process.
4. Bugs fixed (https://bugzilla.redhat.com/):
1019052 - CVE-2013-4424 GateIn: XSS due to improper url escaping
5. References:
https://www.redhat.com/security/data/cve/CVE-2013-4424.html
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal&downloadType=securityPatches&version=6.1.0
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2013 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFSr0rdXlSAg2UNWIIRAi7WAJ4/iWjuTIeLU+itHM20BGDSFte2yACgm/FN
4nY49zBG25qBD319obxFy60=
=Ib3Z
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUq+zyhLndAQH1ShLAQIA/w/9FhOARZCj4gwpvxi3G6d+OBeBiS4M/oJP
QPGfADLr2BbjFdGISP/V1gXbvoMOX3Z8Zyld/r9cPHGhEc85wemdaiT/h81YCEWj
AMY6UMqvi1wbQcv5BT270Z5dyiyJXg4mrKUGk7e+8Jc/rUQCFFG/TdlEXdqZtd9a
FlMmLOTSoCJsesEAonxWYTpqbYCd7KAJUb6pQ1PRWEj1CWBIXRLHGWeObJoB+b23
OdDnUBq5lpEbCAK73wR4c5hC+vBeBGf6jt+6r6EaWEobMeiQXGyus34xBemg1Uww
FOEyiAP4JHMdsQ4MhNGivrwbsTjFS2KkJpXD1wCb2045PkWDOpZDI/RZKCJzv4ul
oQauNDixQ7lzge1awdIYv7FAkPk7zoU/5hGJlVWE50l1GkIhr5+PX80l91/D90Pw
3wxdHRQELOUPxQPutRhtdD3OcHcP6T+iv5XYljcq6kCqECN/9/Jb9vR9J3ldP3KH
zvtyt4A3WqJgjumvuKmMDJjpOvg1tNS6J1f0UsbnKZa4ygjCdZNDAByA0rXhNeLM
t1wbWQp4sHsueMBS8b/GF/bT24aviqAZt8SnfOwHMT0tWDnxa87Yk/HqEJGKHWny
IohbYTvdEuJAPz7PzcsPYNYF+K1nYW4dEhHB+YGw+RDw+13qHUksTjOJIaZ7PB++
2BVph9yt2XA=
=YO+v
-----END PGP SIGNATURE-----