Detections
Analytics

RHEL 5 : JBoss EAP (RHSA-2013:1784)

medium Nessus Plugin ID 71900

Language:

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

An update for Red Hat JBoss Enterprise Application Platform 6.2.0, which fixes two security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7.

The HawtJNI Library class wrote native libraries to a predictable file name in /tmp/ when the native libraries were bundled in a JAR file, and no custom library path was specified. A local attacker could overwrite these native libraries with malicious versions during the window between when HawtJNI writes them and when they are executed.
(CVE-2013-2035)

A flaw was found in the way method-level authorization for JAX-WS Service endpoints was performed by the EJB invocation handler implementation. Any restrictions declared on EJB methods were ignored when executing the JAX-WS handlers, and only class-level restrictions were applied. A remote attacker who is authorized to access the EJB class, could invoke a JAX-WS handler which they were not authorized to invoke. (CVE-2013-2133)

The CVE-2013-2035 issue was discovered by Florian Weimer of the Red Hat Product Security Team, and the CVE-2013-2133 issue was discovered by Richard Opalka and Arun Neelicattu of Red Hat.

This release serves as a replacement for JBoss Enterprise Application Platform 6.1.1, and includes bug fixes and enhancements. Documentation for these changes will be available shortly from the JBoss Enterprise Application Platform 6.2.0 Release Notes, linked to in the References.

All users of Red Hat JBoss Enterprise Application Platform 6.2.0 as provided from the Red Hat Customer Portal are advised to apply this update. The JBoss server process must be restarted for the update to take effect.

This plugin does not check for JBoss installs on the following remote filesystem types: NFS, AFS, SMBFS, CIFS.

Solution

Upgrade to JBoss Enterprise Application Platform 6.2.0.

See Also

https://www.redhat.com/security/data/cve/CVE-2013-2035.html

https://www.redhat.com/security/data/cve/CVE-2013-2133.html

http://rhn.redhat.com/errata/RHSA-2013-1784.html

Plugin Details

Severity: Medium

ID: 71900

File Name: redhat-RHSA-2013-1784.nasl

Version: 1.10

Type: local

Agent: unix

Published: 1/10/2014

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

Vulnerability Information

CPE: cpe:/a:redhat:jboss_enterprise_application_platform:6.2.0

Required KB Items: Host/local_checks_enabled, Host/RedHat/release

Exploit Ease: No known exploits are available

Patch Publication Date: 12/4/2013

Vulnerability Publication Date: 8/28/2013

Reference Information

CVE: CVE-2013-2035, CVE-2013-2133

BID: 59876, 64125

RHSA: 2013:1784