-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: openssl security update
Advisory ID:       RHSA-2012:1308-01
Product:           JBoss Enterprise Application Platform
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2012-1308.html
Issue date:        2012-09-24
CVE Names:         CVE-2011-4108 CVE-2011-4109 CVE-2011-4576 
                   CVE-2011-4619 CVE-2012-0884 CVE-2012-1165 
                   CVE-2012-2110 CVE-2012-2333 
=====================================================================

1. Summary:

An update for the OpenSSL component for JBoss Enterprise Application
Platform 6.0.0 for Solaris and Microsoft Windows that fixes multiple
security issues is now available from the Red Hat Customer Portal.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

2. Description:

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols, as well as a
full-strength, general purpose cryptography library.

Multiple numeric conversion errors, leading to a buffer overflow, were
found in the way OpenSSL parsed ASN.1 (Abstract Syntax Notation One) data
from BIO (OpenSSL's I/O abstraction) inputs. Specially-crafted DER
(Distinguished Encoding Rules) encoded data read from a file or other BIO
input could cause an application using the OpenSSL library to crash or,
potentially, execute arbitrary code. (CVE-2012-2110)

A double free flaw was discovered in the policy checking code in OpenSSL.
A remote attacker could use this flaw to crash an application that uses
OpenSSL by providing an X.509 certificate that has specially-crafted
policy extension data. (CVE-2011-4109)

An information leak flaw was found in the SSL 3.0 protocol implementation
in OpenSSL. Incorrect initialization of SSL record padding bytes could
cause an SSL client or server to send a limited amount of possibly
sensitive data to its SSL peer via the encrypted connection.
(CVE-2011-4576)

It was discovered that OpenSSL did not limit the number of TLS/SSL
handshake restarts required to support Server Gated Cryptography. A remote
attacker could use this flaw to make a TLS/SSL server using OpenSSL consume
an excessive amount of CPU by continuously restarting the handshake.
(CVE-2011-4619)

This update also fixes additional security issues in OpenSSL that are not
exposed in JBoss Enterprise Application Platform: CVE-2011-4108,
CVE-2012-0884, CVE-2012-1165, and CVE-2012-2333.

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation and deployed applications, and
also back up your existing Apache HTTP Server installation (including all
applications and configuration files).

All users of JBoss Enterprise Application Platform 6.0.0 for Solaris and
Microsoft Windows as provided from the Red Hat Customer Portal are advised
to apply this update.

3. Solution:

The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing JBoss Enterprise Application Platform installation and deployed
applications, and also back up your existing Apache HTTP Server
installation (including all applications and configuration files).

The Apache HTTP Server, as well as JBoss server instances configured to use
the Tomcat Native library, must be restarted for this update to take
effect.

4. Bugs fixed (http://bugzilla.redhat.com/):

771770 - CVE-2011-4108 openssl: DTLS plaintext recovery attack
771771 - CVE-2011-4109 openssl: double-free in policy checks
771775 - CVE-2011-4576 openssl: uninitialized SSL 3.0 padding
771780 - CVE-2011-4619 openssl: SGC restart DoS attack
802489 - CVE-2012-1165 openssl: mime_param_cmp NULL dereference crash
802725 - CVE-2012-0884 openssl: CMS and PKCS#7 Bleichenbacher attack
814185 - CVE-2012-2110 openssl: asn1_d2i_read_bio integer errors leading to buffer overflow
820686 - CVE-2012-2333 openssl: record length handling integer underflow

5. References:

https://www.redhat.com/security/data/cve/CVE-2011-4108.html
https://www.redhat.com/security/data/cve/CVE-2011-4109.html
https://www.redhat.com/security/data/cve/CVE-2011-4576.html
https://www.redhat.com/security/data/cve/CVE-2011-4619.html
https://www.redhat.com/security/data/cve/CVE-2012-0884.html
https://www.redhat.com/security/data/cve/CVE-2012-1165.html
https://www.redhat.com/security/data/cve/CVE-2012-2110.html
https://www.redhat.com/security/data/cve/CVE-2012-2333.html
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.0.0

6. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFQYIWVXlSAg2UNWIIRAnQAAJ4sJHSdVIcJ+L/lv5GbpA6ACqopbACePszM
HdiI0G5eFHP1ZFRXVrTzZ58=
=87qT
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce