Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack. From Apache CXF 3.2.1 and 3.1.14, message attachment headers that are greater than 300 characters will be rejected by default. This value is configurable via the property "attachment-max-header-size".

The IBM WebSphere Application Server running on the remote host is version 9.0.x prior to 9.0.0.7. It is, therefore, affected by a denial of service (DoS) vulnerability in the Apache CXF subcomponent. An unauthenticated, remote attacker can exploit this, by using a specially crafted message attachment header, in order to cause the JAX-RS service to stop responding.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2424 advisory.

  - cxf: Improper size validation in message attachment header for JAX-WS and JAX-RS services (CVE-2017-12624)

  - apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* (CVE-2018-8039)

  - guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote     attackers to cause a denial of service (CVE-2018-10237)

  - wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)     (CVE-2018-10862)

  - bouncycastle: flaw in the low-level interface to RSA key pair generator (CVE-2018-1000180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2423 advisory.

    Red Hat JBoss Enterprise Application Platform is a platform for Java     applications based on the JBoss Application Server.

    This release of Red Hat JBoss Enterprise Application Platform 7.1.4 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.1.3, and includes bug fixes and enhancements, which are documented     in the Release Notes document linked to in the References.

    Security Fix(es):

    * guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote     attackers to cause a denial of service (CVE-2018-10237)

    * bouncycastle: flaw in the low-level interface to RSA key pair generator (CVE-2018-1000180)

    * cxf: Improper size validation in message attachment header for JAX-WS and JAX-RS services     (CVE-2017-12624)

    * wildfly: wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files     (CVE-2018-10862)

    * cxf-core: apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*     (CVE-2018-8039)

    For more details about the security issue(s), including the impact, a CVSS     score, and other related information, refer to the CVE page(s) listed in the     References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
141563	IBM WebSphere Application Server 9.0.x < 9.0.0.7 DoS (CVE-2017-12624)	Nessus	Web Servers	medium
112030	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.4 on RHEL7 (RHSA-2018:2424)	Nessus	Red Hat Local Security Checks	high
112029	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.1.4 on RHEL 6 (RHSA-2018:2423)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2017-12624

medium

Tenable Plugins

medium

high

high