RHEL 5：JBoss EAP (RHSA-2013:0839)
medium Nessus 插件 ID 66523
语言：
简介
远程 Red Hat 主机缺少一个或多个安全更新。描述
更新后的 JBoss Enterprise Application Platform 6.1.0 程序包修复了三个安全问题和各种缺陷，并添加了多项增强，现在可用于 Red Hat Enterprise Linux 5。Red Hat 安全响应团队已将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取针对每个漏洞的通用漏洞评分系统 (CVSS) 基本分数，其给出了详细的严重性等级。
JBoss Enterprise Application Platform 6 是适用于基于 JBoss Application Server 7 的 Java 应用程序的平台。
此版本可替换 JBoss Enterprise Application Platform 6.0.1，并包含缺陷补丁和多项增强。有关这些最重要更改的信息，请参阅 6.1.0 发行说明，具体内容短期内将于以下网址中提供：https://access.redhat.com/site/documentation/
安全补丁：
发现各种框架（包括 Apache CXF）中均存在 XML 加密向后兼容性攻击。攻击者可强制服务器使用不安全的旧版密码系统，即使当端点启用安全加密系统时。通过强制使用旧版加密系统，将暴露 CVE-2011-1096 和 CVE-2011-2487 等缺陷，并允许纯文本通过密文和对称密钥恢复。(CVE-2012-5575)
注意：仅当 WS-SecurityPolicy 用于执行安全要求时，才运行可防止 CVE-2012-5575 的自动检查。使用 WS-SecurityPolicy 执行安全要求为最佳做法。
当 JBoss Web 上运行的应用程序使用 COOKIE 会话跟踪方法时，org.apache.catalina.connector.Response.encodeURL() 方法将在处理第一个会话请求时返回 URL（包含附加为查询字符串参数的 jsessionid）。攻击者可能利用此缺陷，通过执行中间人攻击来获取用户的 jsessionid 并点击劫持其会话，或者从日志文件中提取 jsessionid。请注意，默认未使用任何会话跟踪方法，必须配置一种方法。(CVE-2012-4529)
如果多个应用程序采用同一自定义授权模块类名称，并提供其自有实现，被加载的第一个应用程序会将其实现用于使用同一自定义授权模块类名称的所有其他应用程序。本地攻击者可利用此缺陷部署恶意应用程序，从而提供自定义授权模块实现，并根据攻击者提供的规则允许或禁止用户访问。(CVE-2012-4572)
Red Hat 在此感谢 Ruhr-University Bochum 的 Tibor Jager、Kenneth G. Paterson 和 Juraj Somorovsky 报告 CVE-2012-5575。
CVE-2012-4572 由 Red Hat JBoss EAP 质量工程团队的 Josef Cacek 发现。
警告：应用此更新之前，请备份现有 JBoss Enterprise Application Platform 安装程序和部署的应用程序。有关更多详细信息，请参阅“解决方案”部分。
建议 Red Hat Enterprise Linux 5 中的所有 JBoss Enterprise Application Platform 6.0.1 用户升级这些更新后的程序包。
必须重新启动 JBoss 服务器进程才能使更新生效。
解决方案
更新受影响的数据包。另见
https://access.redhat.com/security/cve/cve-2012-4529
https://access.redhat.com/security/cve/cve-2012-4572
https://access.redhat.com/security/cve/cve-2012-5575
https://access.redhat.com/security/cve/cve-2013-2067
https://access.redhat.com/site/documentation/
插件详情
严重性: Medium
ID: 66523
文件名: redhat-RHSA-2013-0839.nasl
版本: 1.29
类型: local
代理: unix
发布时间: 2013/5/21
最近更新时间: 2021/1/14
支持的传感器: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
风险信息
VPR
风险因素: Medium
分数: 5.9
CVSS v2
风险因素: Medium
基本分数: 6.8
时间分数: 5
矢量: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
漏洞信息
CPE: p-cpe:/a:redhat:enterprise_linux:apache-commons-daemon-eap6, p-cpe:/a:redhat:enterprise_linux:apache-commons-daemon-jsvc-eap6, p-cpe:/a:redhat:enterprise_linux:apache-commons-pool-eap6, p-cpe:/a:redhat:enterprise_linux:apache-cxf, p-cpe:/a:redhat:enterprise_linux:apache-cxf-xjc-utils, p-cpe:/a:redhat:enterprise_linux:atinject, p-cpe:/a:redhat:enterprise_linux:atinject-eap6, p-cpe:/a:redhat:enterprise_linux:codehaus-jackson, p-cpe:/a:redhat:enterprise_linux:codehaus-jackson-core-asl, p-cpe:/a:redhat:enterprise_linux:codehaus-jackson-jaxrs, p-cpe:/a:redhat:enterprise_linux:codehaus-jackson-mapper-asl, p-cpe:/a:redhat:enterprise_linux:codehaus-jackson-xc, p-cpe:/a:redhat:enterprise_linux:cxf-xjc-boolean, p-cpe:/a:redhat:enterprise_linux:cxf-xjc-dv, p-cpe:/a:redhat:enterprise_linux:cxf-xjc-ts, p-cpe:/a:redhat:enterprise_linux:dom4j, p-cpe:/a:redhat:enterprise_linux:dom4j-eap6, p-cpe:/a:redhat:enterprise_linux:ecj3, p-cpe:/a:redhat:enterprise_linux:glassfish-javamail, p-cpe:/a:redhat:enterprise_linux:glassfish-jaxb, p-cpe:/a:redhat:enterprise_linux:glassfish-jaxb-eap6, p-cpe:/a:redhat:enterprise_linux:glassfish-jsf, p-cpe:/a:redhat:enterprise_linux:guava, p-cpe:/a:redhat:enterprise_linux:h2database, p-cpe:/a:redhat:enterprise_linux:hibernate4, p-cpe:/a:redhat:enterprise_linux:hibernate4-core, p-cpe:/a:redhat:enterprise_linux:hibernate4-entitymanager, p-cpe:/a:redhat:enterprise_linux:hibernate4-envers, p-cpe:/a:redhat:enterprise_linux:hibernate4-infinispan, p-cpe:/a:redhat:enterprise_linux:hibernate4-validator, p-cpe:/a:redhat:enterprise_linux:hornetq, p-cpe:/a:redhat:enterprise_linux:hornetq-native, p-cpe:/a:redhat:enterprise_linux:httpclient, p-cpe:/a:redhat:enterprise_linux:httpcomponents-client, p-cpe:/a:redhat:enterprise_linux:httpcomponents-core, p-cpe:/a:redhat:enterprise_linux:httpcomponents-project, p-cpe:/a:redhat:enterprise_linux:httpcore, p-cpe:/a:redhat:enterprise_linux:httpd, p-cpe:/a:redhat:enterprise_linux:httpd-devel, p-cpe:/a:redhat:enterprise_linux:httpd-tools, p-cpe:/a:redhat:enterprise_linux:httpmime, p-cpe:/a:redhat:enterprise_linux:infinispan, p-cpe:/a:redhat:enterprise_linux:infinispan-cachestore-jdbc, p-cpe:/a:redhat:enterprise_linux:infinispan-cachestore-remote, p-cpe:/a:redhat:enterprise_linux:infinispan-client-hotrod, p-cpe:/a:redhat:enterprise_linux:infinispan-core, p-cpe:/a:redhat:enterprise_linux:ironjacamar, p-cpe:/a:redhat:enterprise_linux:jacorb-jboss, p-cpe:/a:redhat:enterprise_linux:jansi, p-cpe:/a:redhat:enterprise_linux:jaxbintros, p-cpe:/a:redhat:enterprise_linux:jbosgi-deployment, p-cpe:/a:redhat:enterprise_linux:jbosgi-framework-core, p-cpe:/a:redhat:enterprise_linux:jbosgi-metadata, p-cpe:/a:redhat:enterprise_linux:jbosgi-repository, p-cpe:/a:redhat:enterprise_linux:jbosgi-resolver, p-cpe:/a:redhat:enterprise_linux:jbosgi-spi, p-cpe:/a:redhat:enterprise_linux:jbosgi-vfs, p-cpe:/a:redhat:enterprise_linux:jboss-aesh, p-cpe:/a:redhat:enterprise_linux:jboss-as-appclient, p-cpe:/a:redhat:enterprise_linux:jboss-as-cli, p-cpe:/a:redhat:enterprise_linux:jboss-as-client-all, p-cpe:/a:redhat:enterprise_linux:jboss-as-clustering, p-cpe:/a:redhat:enterprise_linux:jboss-as-cmp, p-cpe:/a:redhat:enterprise_linux:jboss-as-configadmin, p-cpe:/a:redhat:enterprise_linux:jboss-as-connector, p-cpe:/a:redhat:enterprise_linux:jboss-as-console, p-cpe:/a:redhat:enterprise_linux:jboss-as-controller, p-cpe:/a:redhat:enterprise_linux:jboss-as-controller-client, p-cpe:/a:redhat:enterprise_linux:jboss-as-deployment-repository, p-cpe:/a:redhat:enterprise_linux:jboss-as-deployment-scanner, p-cpe:/a:redhat:enterprise_linux:jboss-as-domain-http, p-cpe:/a:redhat:enterprise_linux:jboss-as-domain-management, p-cpe:/a:redhat:enterprise_linux:jboss-as-ee, p-cpe:/a:redhat:enterprise_linux:jboss-as-ee-deployment, p-cpe:/a:redhat:enterprise_linux:jboss-as-ejb3, p-cpe:/a:redhat:enterprise_linux:jboss-as-embedded, p-cpe:/a:redhat:enterprise_linux:jboss-as-host-controller, p-cpe:/a:redhat:enterprise_linux:jboss-as-jacorb, p-cpe:/a:redhat:enterprise_linux:jboss-as-jaxr, p-cpe:/a:redhat:enterprise_linux:jboss-as-jaxrs, p-cpe:/a:redhat:enterprise_linux:jboss-as-jdr, p-cpe:/a:redhat:enterprise_linux:jboss-as-jmx, p-cpe:/a:redhat:enterprise_linux:jboss-as-jpa, p-cpe:/a:redhat:enterprise_linux:jboss-as-jsf, p-cpe:/a:redhat:enterprise_linux:jboss-as-jsr77, p-cpe:/a:redhat:enterprise_linux:jboss-as-logging, p-cpe:/a:redhat:enterprise_linux:jboss-as-mail, p-cpe:/a:redhat:enterprise_linux:jboss-as-management-client-content, p-cpe:/a:redhat:enterprise_linux:jboss-as-messaging, p-cpe:/a:redhat:enterprise_linux:jboss-as-modcluster, p-cpe:/a:redhat:enterprise_linux:jboss-as-naming, p-cpe:/a:redhat:enterprise_linux:jboss-as-network, p-cpe:/a:redhat:enterprise_linux:jboss-as-osgi, p-cpe:/a:redhat:enterprise_linux:jboss-as-osgi-configadmin, p-cpe:/a:redhat:enterprise_linux:jboss-as-osgi-service, p-cpe:/a:redhat:enterprise_linux:jboss-as-platform-mbean, p-cpe:/a:redhat:enterprise_linux:jboss-as-pojo, p-cpe:/a:redhat:enterprise_linux:jboss-as-process-controller, p-cpe:/a:redhat:enterprise_linux:jboss-as-protocol, p-cpe:/a:redhat:enterprise_linux:jboss-as-remoting, p-cpe:/a:redhat:enterprise_linux:jboss-as-sar, p-cpe:/a:redhat:enterprise_linux:jboss-as-security, p-cpe:/a:redhat:enterprise_linux:jboss-as-server, p-cpe:/a:redhat:enterprise_linux:jboss-as-system-jmx, p-cpe:/a:redhat:enterprise_linux:jboss-as-threads, p-cpe:/a:redhat:enterprise_linux:jboss-as-transactions, p-cpe:/a:redhat:enterprise_linux:jboss-as-version, p-cpe:/a:redhat:enterprise_linux:jboss-as-web, p-cpe:/a:redhat:enterprise_linux:jboss-as-webservices, p-cpe:/a:redhat:enterprise_linux:jboss-as-weld, p-cpe:/a:redhat:enterprise_linux:jboss-as-xts, p-cpe:/a:redhat:enterprise_linux:jboss-common-beans, p-cpe:/a:redhat:enterprise_linux:jboss-dmr, p-cpe:/a:redhat:enterprise_linux:jboss-ejb-client, p-cpe:/a:redhat:enterprise_linux:jboss-jaxrpc-api_1.1_spec, p-cpe:/a:redhat:enterprise_linux:jboss-jaxrs-api_1.1_spec, p-cpe:/a:redhat:enterprise_linux:jboss-jms-api_1.1_spec, p-cpe:/a:redhat:enterprise_linux:jboss-jsf-api_2.1_spec, p-cpe:/a:redhat:enterprise_linux:jboss-logmanager, p-cpe:/a:redhat:enterprise_linux:jboss-marshalling, p-cpe:/a:redhat:enterprise_linux:jboss-metadata, p-cpe:/a:redhat:enterprise_linux:jboss-metadata-appclient, p-cpe:/a:redhat:enterprise_linux:jboss-metadata-common, p-cpe:/a:redhat:enterprise_linux:jboss-metadata-ear, p-cpe:/a:redhat:enterprise_linux:jboss-metadata-ejb, p-cpe:/a:redhat:enterprise_linux:jboss-metadata-web, p-cpe:/a:redhat:enterprise_linux:jboss-modules, p-cpe:/a:redhat:enterprise_linux:jboss-msc, p-cpe:/a:redhat:enterprise_linux:jboss-remote-naming, p-cpe:/a:redhat:enterprise_linux:jboss-remoting3, p-cpe:/a:redhat:enterprise_linux:jboss-remoting3-jmx, p-cpe:/a:redhat:enterprise_linux:jboss-security-negotiation, p-cpe:/a:redhat:enterprise_linux:jboss-servlet-api_3.0_spec, p-cpe:/a:redhat:enterprise_linux:jboss-threads, p-cpe:/a:redhat:enterprise_linux:jboss-transaction-api_1.1_spec, p-cpe:/a:redhat:enterprise_linux:jbossas-appclient, p-cpe:/a:redhat:enterprise_linux:jbossas-bundles, p-cpe:/a:redhat:enterprise_linux:jbossas-core, p-cpe:/a:redhat:enterprise_linux:jbossas-domain, p-cpe:/a:redhat:enterprise_linux:jbossas-hornetq-native, p-cpe:/a:redhat:enterprise_linux:jbossas-javadocs, p-cpe:/a:redhat:enterprise_linux:jbossas-jbossweb-native, p-cpe:/a:redhat:enterprise_linux:jbossas-modules-eap, p-cpe:/a:redhat:enterprise_linux:jbossas-product-eap, p-cpe:/a:redhat:enterprise_linux:jbossas-standalone, p-cpe:/a:redhat:enterprise_linux:jbossas-welcome-content-eap, p-cpe:/a:redhat:enterprise_linux:jbossts, p-cpe:/a:redhat:enterprise_linux:jbossweb, p-cpe:/a:redhat:enterprise_linux:jbossws-api, p-cpe:/a:redhat:enterprise_linux:jbossws-common, p-cpe:/a:redhat:enterprise_linux:jbossws-common-tools, p-cpe:/a:redhat:enterprise_linux:jbossws-cxf, p-cpe:/a:redhat:enterprise_linux:jbossws-native, p-cpe:/a:redhat:enterprise_linux:jbossws-spi, p-cpe:/a:redhat:enterprise_linux:jcip-annotations, p-cpe:/a:redhat:enterprise_linux:jcip-annotations-eap6, p-cpe:/a:redhat:enterprise_linux:jgroups, p-cpe:/a:redhat:enterprise_linux:joda-time, p-cpe:/a:redhat:enterprise_linux:jul-to-slf4j-stub, p-cpe:/a:redhat:enterprise_linux:mod_cluster, p-cpe:/a:redhat:enterprise_linux:mod_cluster-demo, p-cpe:/a:redhat:enterprise_linux:mod_cluster-native, p-cpe:/a:redhat:enterprise_linux:mod_jk-ap22, p-cpe:/a:redhat:enterprise_linux:mod_ssl, p-cpe:/a:redhat:enterprise_linux:netty, p-cpe:/a:redhat:enterprise_linux:objectweb-asm-eap6, p-cpe:/a:redhat:enterprise_linux:opensaml, p-cpe:/a:redhat:enterprise_linux:openws, p-cpe:/a:redhat:enterprise_linux:org.osgi.core, p-cpe:/a:redhat:enterprise_linux:org.osgi.enterprise, p-cpe:/a:redhat:enterprise_linux:picketbox, p-cpe:/a:redhat:enterprise_linux:picketlink-federation, p-cpe:/a:redhat:enterprise_linux:relaxngdatatype, p-cpe:/a:redhat:enterprise_linux:relaxngdatatype-eap6, p-cpe:/a:redhat:enterprise_linux:resteasy, p-cpe:/a:redhat:enterprise_linux:slf4j, p-cpe:/a:redhat:enterprise_linux:slf4j-eap6, p-cpe:/a:redhat:enterprise_linux:slf4j-jboss-logmanager, p-cpe:/a:redhat:enterprise_linux:sun-ws-metadata-2.0-api, p-cpe:/a:redhat:enterprise_linux:tomcat-native, p-cpe:/a:redhat:enterprise_linux:velocity-eap6, p-cpe:/a:redhat:enterprise_linux:weld-cdi-1.0-api, p-cpe:/a:redhat:enterprise_linux:weld-core, p-cpe:/a:redhat:enterprise_linux:woodstox-core, p-cpe:/a:redhat:enterprise_linux:woodstox-stax2-api, p-cpe:/a:redhat:enterprise_linux:wsdl4j-eap6, p-cpe:/a:redhat:enterprise_linux:wss4j, p-cpe:/a:redhat:enterprise_linux:xerces-j2-eap6, p-cpe:/a:redhat:enterprise_linux:xml-commons-resolver-eap6, p-cpe:/a:redhat:enterprise_linux:xml-security, p-cpe:/a:redhat:enterprise_linux:xmltooling, cpe:/o:redhat:enterprise_linux:5
必需的 KB 项: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
易利用性: No known exploits are available
补丁发布日期: 2013/5/20
参考资料信息
CVE: CVE-2012-4529, CVE-2012-4572, CVE-2012-5575, CVE-2013-2067
RHSA: 2013:0839