RHSA-2015:0849: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.0 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.4.0, and fix multiple security issues, several bugs, and add various enhancements, are now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was found that a prior countermeasure in Apache WSS4J for Bleichenbacher’s attack on XML Encryption (CVE-2011-2487) threw an exception that permitted an attacker to determine the failure of the attempted attack, thereby leaving WSS4J vulnerable to the attack. The original flaw allowed a remote attacker to recover the entire plain text form of a symmetric key. (CVE-2015-0226) A flaw was found in the way PicketLink’s Service Provider and Identity Provider handled certain requests. A remote attacker could use this flaw to log to a victim’s account via PicketLink. (CVE-2015-0277) It was discovered that a JkUnmount rule for a subtree of a previous JkMount rule could be ignored. This could allow a remote attacker to potentially access a private artifact in a tree that would otherwise not be accessible to them. (CVE-2014-8111) It was discovered that OpenSSL would accept ephemeral RSA keys when using non-export RSA cipher suites. A malicious server could make a TLS/SSL client using OpenSSL use a weaker key exchange method. (CVE-2015-0204) It was found that Apache WSS4J permitted bypass of the requireSignedEncryptedDataElements configuration property via XML Signature wrapping attacks. A remote attacker could use this flaw to modify the contents of a signed request. (CVE-2015-0227) It was found that OpenSSL’s BigNumber Squaring implementation could produce incorrect results under certain special conditions. This flaw could possibly affect certain OpenSSL library functionality, such as RSA blinding. Note that this issue occurred rarely and with a low probability, and there is currently no known way of exploiting it. (CVE-2014-3570) It was found that the Command Line Interface, as provided by Red Hat Enterprise Application Platform, created a history file named .jboss-cli-history in the user’s home directory with insecure default file permissions. This could allow a malicious local user to gain information otherwise not accessible to them. (CVE-2014-3586) The CVE-2015-0277 issue was discovered by Ondrej Kotek of Red Hat. This release of JBoss Enterprise Application Platform also includes bug fixes and enhancements. Documentation for these changes will be available shortly from the JBoss Enterprise Application Platform 6.4.0 Release Notes, linked to in the References. All users of Red Hat JBoss Enterprise Application Platform 6.3 as provided from the Red Hat Customer Portal are advised to apply this update. The JBoss server process must be restarted for the update to take effect. Related CVEs:

• CVE-2014-3570: openssl: Bignum squaring may produce incorrect results
• CVE-2014-3586: JBoss AS CLI: Insecure default permissions on history file
• CVE-2014-8111: Tomcat mod_jk: information leak due to incorrect JkMount/JkUnmount directives processing
• CVE-2015-0204: openssl: only allow ephemeral RSA keys in export ciphersuites (FREAK)
• CVE-2015-0226: wss4j: Apache WSS4J is vulnerable to Bleichenbacher’s attack (incomplete fix for CVE-2011-2487)
• CVE-2015-0227: wss4j: Apache WSS4J doesn’t correctly enforce the requireSignedEncryptedDataElements property
• CVE-2015-0277: PicketLink: SP does not take Audience condition of a SAML assertion into account
• CVE-2015-6254: PicketLink: Lack of validation for the Destination attribute in a Response element in a SAML assertion