Advisory - Security Bypass Vulnerability in Red Hat Jboss Enterprise Platform

[varun]

Security Bypass Vulnerability in Red Hat Jboss Enterprise Application Platform

Severity Rating: Medium

Systems Affected
• JBoss Enterprise Application Platform 6.x

Overview

A vulnerability has been reported in Red Hat JBoss Enterprise Application Platform which could be exploited by remote attacker to bypass certain security restrictions.

Description
The Java Security Manager (JSM) of the JBoss EAP fails to properly apply the permissions that are defined in a policy file. Due to the improper permission application the java.security.AllPermission grants permission to all the applications, which could allow remote attackers to bypass security restrictions.

Solution
Update to version 6.2.2

https://access.redhat.com/jbossnetwo...&version=6.2.0

Vendor Information
Redhat
https://rhn.redhat.com/errata/RHSA-2014-0343.html
https://rhn.redhat.com/errata/RHSA-2014-0344.html
https://rhn.redhat.com/errata/RHSA-2014-0345.html

References
Redhat
https://rhn.redhat.com/errata/RHSA-2014-0343.html
https://rhn.redhat.com/errata/RHSA-2014-0344.html
https://rhn.redhat.com/errata/RHSA-2014-0345.html
https://bugzilla.redhat.com/show_bug...=CVE-2014-0093

SecureList
http://www.securelist.com/en/advisories/57675


Secunia
http://secunia.com/advisories/57675

[varun]

Arbitrary Code Execution Vulnerability in JBoss

Severity Rating: Medium

Systems Affected
• Red Hat JBoss Enterprise Application Platform 5.2.0
• Red Hat JBoss BRMS 5.3.1
• Red Hat JBoss Portal Platform 5.2.2
• Red Hat JBoss SOA Platform 5.3.1

Components Affected
• JBoss Remoting

Overview
A vulnerability has been reported in Red Hat JBoss Remoting, which could allow a remote attacker to execute arbitrary code on a vulnerable server.
Only the unsupported Red Hat JBoss 5.x products having default configuration are affected by this vulnerability.

Description
This vulnerability exists due to improper implementation of authentication and authorization mechanisms in JBoss remoting component.
A remote attackercould successfully exploit this vulnerability and execute arbitrary code.
This vulnerability exists only if if JMX remoting is enabled by manually deploying jmx-remoting.sar from the jboss-as/docs/examples directory.

Solution
Apply the appropriate fix/patch as mentioned by the vendor:- https://rhn.redhat.com/errata/RHSA-2014-0887.html

Vendor Information
RedHat https://rhn.redhat.com/errata/RHSA-2014-0887.html

References
Security Database http://www.security-database.com/det...=CVE-2014-3518

[varun]

Information Disclosure Vulnerability in Red Hat JBoss Enterprise Application Platform

Severity Rating: Medium

Systems Affected
• Red Hat JBoss Enterprise Application Platform 5.2.0
• JBoss Enterprise Application Platform 6 and 6.2 EL5
• JBoss Enterprise Application Platform 6 and 6.2 EL6
• JBoss Enterprise Application Platform 5 EL4, EL5 and EL6
Overview
A vulnerability has been reported in Red Hat JBoss Enterprise Application Platform, which could allow a remote, unauthenticated attacker to access files on the target system.

Description
This vulnerability exists due to improper implementation of org.picketlink.common.util. DocumentUtil.getDocumentBuilderFactory() method which also provides a DocumentBuilderFactory which causes expanded entity references.
A remote, unauthenticated attacker could successfully exploit this vulnerability by providing specially crafted XML External Entity (XXE) data, and access files on the target system with the privileges of the
target JBoss server.

Solution
Apply the appropriate fix/patch as mentioned by the vendor:-
https://rhn.redhat.com/errata/RHSA-2014-0883.html
https://rhn.redhat.com/errata/RHSA-2014-0884.html
https://rhn.redhat.com/errata/RHSA-2014-0885.html
https://rhn.redhat.com/errata/RHSA-2014-0886.html
https://rhn.redhat.com/errata/RHSA-2014-0887.html

Vendor Information
RedHat

https://rhn.redhat.com/errata/RHSA-2014-0883.html
https://rhn.redhat.com/errata/RHSA-2014-0884.html
https://rhn.redhat.com/errata/RHSA-2014-0885.html
https://rhn.redhat.com/errata/RHSA-2014-0886.html
https://rhn.redhat.com/errata/RHSA-2014-0887.html

References
Securitytracker
http://www.securitytracker.com/id/1030607

Security Database
http://www.security-database.com/det...=CVE-2014-3530