Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2015.0391
Important: Red Hat JBoss BPM Suite 6.0.3 security update
18 February 2015
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Red Hat JBoss BPM Suite 6.0.3
Red Hat JBoss BRMS 6.0.3
Publisher: Red Hat
Operating System: Windows
Red Hat
Solaris
AIX
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Modify Arbitrary Files -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Cross-site Scripting -- Remote with User Interaction
Provide Misleading Information -- Remote with User Interaction
Access Confidential Data -- Remote/Unauthenticated
Unauthorised Access -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2014-8115 CVE-2014-8114 CVE-2014-3682
CVE-2014-3625 CVE-2014-3578 CVE-2014-3577
CVE-2014-3558 CVE-2014-3530 CVE-2014-3490
CVE-2014-3472 CVE-2014-0227 CVE-2014-0193
CVE-2014-0119 CVE-2014-0099 CVE-2014-0096
CVE-2014-0075 CVE-2014-0005 CVE-2013-5855
CVE-2013-4002 CVE-2012-6153 CVE-2012-5783
Reference: ASB-2014.0121
ASB-2014.0077
ASB-2013.0113
ESB-2015.0311
ESB-2015.0280
ESB-2014.1126
ESB-2014.1092.2
ESB-2014.1073
ESB-2014.1064
ESB-2013.1120
ESB-2013.1099
ESB-2013.1077
ESB-2013.0227
Original Bulletin:
https://rhn.redhat.com/errata/RHSA-2015-0234.html
https://rhn.redhat.com/errata/RHSA-2015-0235.html
Comment: This advisory references vulnerabilities in products which run on
platforms other than Red Hat. It is recommended that administrators
running Red Hat JBoss BPM Suite 6.0.3 or Red Hat JBoss BRMS 6.0.3
check for an updated version of the software for their operating
system.
This bulletin contains two (2) Red Hat security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat JBoss BPM Suite 6.0.3 security update
Advisory ID: RHSA-2015:0234-01
Product: Red Hat JBoss BPM Suite
Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0234.html
Issue date: 2015-02-17
CVE Names: CVE-2012-6153 CVE-2013-4002 CVE-2013-5855
CVE-2014-0005 CVE-2014-0075 CVE-2014-0096
CVE-2014-0099 CVE-2014-0119 CVE-2014-0193
CVE-2014-0227 CVE-2014-3472 CVE-2014-3490
CVE-2014-3530 CVE-2014-3558 CVE-2014-3577
CVE-2014-3578 CVE-2014-3625 CVE-2014-3682
CVE-2014-8114 CVE-2014-8115
=====================================================================
1. Summary:
Red Hat JBoss BPM Suite 6.0.3 roll up patch 2, which fixes multiple
security issues, several bugs, and adds various enhancements, is now
available from the Red Hat Customer Portal.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
2. Description:
Red Hat JBoss BPM Suite is a business rules and processes management system
for the management, storage, creation, modification, and deployment of
JBoss rules and BPMN2-compliant business processes.
This roll up patch serves as a cumulative upgrade for Red Hat JBoss BPM
Suite 6.0.3, and includes bug fixes and enhancements. It includes various
bug fixes, which are listed in the README file included with the patch
files.
The following security issues are also fixed with this release,
descriptions of which can be found on the respective CVE pages linked in
the References section.
CVE-2012-6153 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-5783 fix
CVE-2014-3577 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-6153 fix
CVE-2013-4002 xerces-j2: Xerces-J2 OpenJDK: XML parsing Denial of Service
(JAXP, 8017298)
CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of
user-supplied content in outputText tags and EL expressions
CVE-2014-0005 security: PicketBox/JBossSX: Unauthorized access to and
modification of application server configuration and state by application
CVE-2014-0075 jbossweb: tomcat: Limited DoS in chunked transfer encoding
input filter
CVE-2014-0096 jbossweb: Apache Tomcat: XXE vulnerability via user supplied
XSLTs
CVE-2014-0099 jbossweb: Apache Tomcat: Request smuggling via malicious
content length header
CVE-2014-0119 jbossweb: Apache Tomcat 6: XML parser hijack by malicious web
application
CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation
CVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding
input filter
CVE-2014-3472 jboss-as-controller: JBoss AS Security: Invalid EJB caller
role check implementation
CVE-2014-3490 RESTEasy: XXE via parameter entities
CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage
CVE-2014-3558 hibernate-validator: Hibernate Validator: JSM bypass via
ReflectionHelper
CVE-2014-3578 spring: Spring Framework: Directory traversal
CVE-2014-3625 spring: Spring Framework: directory traversal flaw
CVE-2014-3682 jbpm-designer: XXE in BPMN2 import
CVE-2014-8114 UberFire: Information disclosure and RCE via insecure file
upload/download servlets
CVE-2014-8115 KIE Workbench: Insufficient authorization constraints
Red Hat would like to thank James Roper of Typesafe for reporting the
CVE-2014-0193 issue, CA Technologies for reporting the CVE-2014-3472 issue,
Alexander Papadakis for reporting the CVE-2014-3530 issue, and David Jorm
for reporting the CVE-2014-8114 and CVE-2014-8115 issues. The CVE-2012-6153
issue was discovered by Florian Weimer of Red Hat Product Security; the
CVE-2014-0005 issue was discovered by Josef Cacek of the Red Hat JBoss EAP
Quality Engineering team; the CVE-2014-0075, CVE-2014-3490, and
CVE-2014-3682 issues were discovered by David Jorm of Red Hat Product
Security.
All users of Red Hat JBoss BPM Suite 6.0.3 as provided from the Red Hat
Customer Portal are advised to apply this roll up patch.
3. Solution:
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing installation, including all applications, configuration files,
databases and database settings, and so on.
It is recommended to halt the server by stopping the JBoss Application
Server process before installing this update, and then after installing
the update, restart the server by starting the JBoss Application Server
process.
4. Bugs fixed (https://bugzilla.redhat.com/):
1019176 - CVE-2013-4002 Xerces-J2 OpenJDK: XML parsing Denial of Service (JAXP, 8017298)
1049736 - CVE-2014-0005 PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application
1065139 - CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions
1072776 - CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter
1088342 - CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs
1092783 - CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation
1102030 - CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header
1102038 - CVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web application
1103815 - CVE-2014-3472 JBoss AS Security: Invalid EJB caller role check implementation
1107901 - CVE-2014-3490 RESTEasy: XXE via parameter entities
1109196 - CVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter
1112987 - CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage
1120495 - CVE-2014-3558 Hibernate Validator: JSM bypass via ReflectionHelper
1129074 - CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix
1129916 - CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix
1131882 - CVE-2014-3578 Spring Framework: Directory traversal
1148260 - CVE-2014-3682 jbpm-designer: XXE in BPMN2 import
1165936 - CVE-2014-3625 Spring Framework: directory traversal flaw
1169544 - CVE-2014-8114 UberFire: Information disclosure and RCE via insecure file upload/download servlets
1169545 - CVE-2014-8115 KIE Workbench: Insufficient authorization constraints
5. References:
https://access.redhat.com/security/cve/CVE-2012-6153
https://access.redhat.com/security/cve/CVE-2013-4002
https://access.redhat.com/security/cve/CVE-2013-5855
https://access.redhat.com/security/cve/CVE-2014-0005
https://access.redhat.com/security/cve/CVE-2014-0075
https://access.redhat.com/security/cve/CVE-2014-0096
https://access.redhat.com/security/cve/CVE-2014-0099
https://access.redhat.com/security/cve/CVE-2014-0119
https://access.redhat.com/security/cve/CVE-2014-0193
https://access.redhat.com/security/cve/CVE-2014-0227
https://access.redhat.com/security/cve/CVE-2014-3472
https://access.redhat.com/security/cve/CVE-2014-3490
https://access.redhat.com/security/cve/CVE-2014-3530
https://access.redhat.com/security/cve/CVE-2014-3558
https://access.redhat.com/security/cve/CVE-2014-3577
https://access.redhat.com/security/cve/CVE-2014-3578
https://access.redhat.com/security/cve/CVE-2014-3625
https://access.redhat.com/security/cve/CVE-2014-3682
https://access.redhat.com/security/cve/CVE-2014-8114
https://access.redhat.com/security/cve/CVE-2014-8115
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite&downloadType=distributions&version=6.0.3
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2015 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFU48FxXlSAg2UNWIIRArUdAJ0cSD7p3xeDGnP1gmsO3qcsU847JQCfdWUE
0zGlE5yihaJeb8t2i3u7JAw=
=DXIH
- -----END PGP SIGNATURE-----
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat JBoss BRMS 6.0.3 security update
Advisory ID: RHSA-2015:0235-01
Product: Red Hat JBoss BRMS
Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0235.html
Issue date: 2015-02-17
CVE Names: CVE-2012-6153 CVE-2013-4002 CVE-2013-5855
CVE-2014-0005 CVE-2014-0075 CVE-2014-0096
CVE-2014-0099 CVE-2014-0119 CVE-2014-0193
CVE-2014-0227 CVE-2014-3472 CVE-2014-3490
CVE-2014-3530 CVE-2014-3558 CVE-2014-3577
CVE-2014-3578 CVE-2014-3625 CVE-2014-3682
CVE-2014-8114 CVE-2014-8115
=====================================================================
1. Summary:
Red Hat JBoss BRMS 6.0.3 roll up patch 2, which fixes multiple security
issues, several bugs, and adds various enhancements, is now available from
the Red Hat Customer Portal.
Red Hat Product Security has rated this update as having Important
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
2. Description:
Red Hat JBoss BRMS is a business rules management system for the
management, storage, creation, modification, and deployment of JBoss
Rules.
This roll up patch serves as a cumulative upgrade for Red Hat JBoss BRMS
6.0.3, and includes bug fixes and enhancements. It includes various bug
fixes, which are listed in the README file included with the patch files.
The following security issues are also fixed with this release,
descriptions of which can be found on the respective CVE pages linked in
the References section.
CVE-2012-6153 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-5783 fix
CVE-2014-3577 Apache HttpComponents client: SSL hostname verification
bypass, incomplete CVE-2012-6153 fix
CVE-2013-4002 xerces-j2: Xerces-J2 OpenJDK: XML parsing Denial of Service
(JAXP, 8017298)
CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of
user-supplied content in outputText tags and EL expressions
CVE-2014-0005 security: PicketBox/JBossSX: Unauthorized access to and
modification of application server configuration and state by application
CVE-2014-0075 jbossweb: tomcat: Limited DoS in chunked transfer encoding
input filter
CVE-2014-0096 jbossweb: Apache Tomcat: XXE vulnerability via user supplied
XSLTs
CVE-2014-0099 jbossweb: Apache Tomcat: Request smuggling via malicious
content length header
CVE-2014-0119 jbossweb: Apache Tomcat 6: XML parser hijack by malicious web
application
CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation
CVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding
input filter
CVE-2014-3472 jboss-as-controller: JBoss AS Security: Invalid EJB caller
role check implementation
CVE-2014-3490 RESTEasy: XXE via parameter entities
CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage
CVE-2014-3558 hibernate-validator: Hibernate Validator: JSM bypass via
ReflectionHelper
CVE-2014-3578 spring: Spring Framework: Directory traversal
CVE-2014-3625 spring: Spring Framework: directory traversal flaw
CVE-2014-3682 jbpm-designer: XXE in BPMN2 import
CVE-2014-8114 UberFire: Information disclosure and RCE via insecure file
upload/download servlets
CVE-2014-8115 KIE Workbench: Insufficient authorization constraints
Red Hat would like to thank James Roper of Typesafe for reporting the
CVE-2014-0193 issue; CA Technologies for reporting the CVE-2014-3472 issue;
Alexander Papadakis for reporting the CVE-2014-3530 issue; and David Jorm
for reporting the CVE-2014-8114 and CVE-2014-8115 issues. The CVE-2012-6153
issue was discovered by Florian Weimer of Red Hat Product Security; the
CVE-2014-0005 issue was discovered by Josef Cacek of the Red Hat JBoss EAP
Quality Engineering team; and the CVE-2014-0075, CVE-2014-3490, and
CVE-2014-3682 issues were discovered by David Jorm of Red Hat Product
Security.
All users of Red Hat JBoss BRMS 6.0.3 as provided from the Red Hat Customer
Portal are advised to apply this roll up patch.
3. Solution:
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing installation, including all applications, configuration files,
databases and database settings, and so on.
It is recommended to halt the server by stopping the JBoss Application
Server process before installing this update, and then after installing the
update, restart the server by starting the JBoss Application Server
process.
4. Bugs fixed (https://bugzilla.redhat.com/):
1019176 - CVE-2013-4002 Xerces-J2 OpenJDK: XML parsing Denial of Service (JAXP, 8017298)
1049736 - CVE-2014-0005 PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application
1065139 - CVE-2013-5855 Mojarra JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions
1072776 - CVE-2014-0075 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter
1088342 - CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs
1092783 - CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation
1102030 - CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header
1102038 - CVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web application
1103815 - CVE-2014-3472 JBoss AS Security: Invalid EJB caller role check implementation
1107901 - CVE-2014-3490 RESTEasy: XXE via parameter entities
1109196 - CVE-2014-0227 Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter
1112987 - CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage
1120495 - CVE-2014-3558 Hibernate Validator: JSM bypass via ReflectionHelper
1129074 - CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix
1129916 - CVE-2012-6153 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix
1131882 - CVE-2014-3578 Spring Framework: Directory traversal
1148260 - CVE-2014-3682 jbpm-designer: XXE in BPMN2 import
1165936 - CVE-2014-3625 Spring Framework: directory traversal flaw
1169544 - CVE-2014-8114 UberFire: Information disclosure and RCE via insecure file upload/download servlets
1169545 - CVE-2014-8115 KIE Workbench: Insufficient authorization constraints
5. References:
https://access.redhat.com/security/cve/CVE-2012-6153
https://access.redhat.com/security/cve/CVE-2013-4002
https://access.redhat.com/security/cve/CVE-2013-5855
https://access.redhat.com/security/cve/CVE-2014-0005
https://access.redhat.com/security/cve/CVE-2014-0075
https://access.redhat.com/security/cve/CVE-2014-0096
https://access.redhat.com/security/cve/CVE-2014-0099
https://access.redhat.com/security/cve/CVE-2014-0119
https://access.redhat.com/security/cve/CVE-2014-0193
https://access.redhat.com/security/cve/CVE-2014-0227
https://access.redhat.com/security/cve/CVE-2014-3472
https://access.redhat.com/security/cve/CVE-2014-3490
https://access.redhat.com/security/cve/CVE-2014-3530
https://access.redhat.com/security/cve/CVE-2014-3558
https://access.redhat.com/security/cve/CVE-2014-3577
https://access.redhat.com/security/cve/CVE-2014-3578
https://access.redhat.com/security/cve/CVE-2014-3625
https://access.redhat.com/security/cve/CVE-2014-3682
https://access.redhat.com/security/cve/CVE-2014-8114
https://access.redhat.com/security/cve/CVE-2014-8115
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms&downloadType=distributions&version=6.0.3
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2015 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFU48OgXlSAg2UNWIIRAsOGAJ96/vEchb5yUljZkqh6yTxkOU1xTQCfRRun
NCMnfXOxYTVjVk9EeS7W9h0=
=IQg9
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVOPOChLndAQH1ShLAQIwoA/9HUcfFt2tvGucFJl5sNyxpsW89QffZEeA
nBGIbS8cw0ORhplSX038zKX3SGNaM+SXllykQLhJWvUksFd7hXpgD0mO9hoOL+NU
y5yDww9q8CXnq+hgLhugUX1+ybJxWEf5fJ/346Wct4yxwJqoH70CBS7iswLfwbSy
SvioZCYeYojK+ojcIU5X+d2KkK4s2nMonZyhhrUlPqJIlrvCx4j6LEDn8YB8Lbyv
Mh/EI6aYbQnATPcp7crV1U41LwxUbdy/pwvgRyoqpedpo7xF5D+Sd3hTzoMatvXN
vENT5tmCDgZqhOEkgpC18G5KaaGVgxD+zMlGQSRc5BVx3YBegfHzaXjnU/YYtAW2
SuXdxFmAcfTfGSU1GC5J4l0w6svzoHVdNF7oLIVgdz1/rBV+HWWJZc8OP57eS6Mh
vHIioYoWM20QtWXoxv8O4KOnau8iiqtdtcXPTey+2vbRhpTt6C++lPhOwIlZxHRq
1iQ0fHTa5HUOWpT8zELFOmSE6QCGDWT71vzJ9eXyrMR1H1N45foTgaA71g1uPTt7
/epKzOhE9bNyYZh649d+Pz0MzkPQgf9nB0VojipcCVkafSMov/3B4PDg3ncqRhm+
sQ/UQFLuTz7R8PIafxiYWX6kaYlq/ThCrTWQfEbm0XGnWykNzJSLAKuxF5knjwU7
MX8OK1Mutrc=
=QGCX
-----END PGP SIGNATURE-----