-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat JBoss Enterprise Application Platform 6.4.0 update
Advisory ID:       RHSA-2015:0849-01
Product:           Red Hat JBoss Enterprise Application Platform
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2015-0849.html
Issue date:        2015-04-16
CVE Names:         CVE-2014-3570 CVE-2014-3586 CVE-2014-8111 
                   CVE-2015-0204 CVE-2015-0226 CVE-2015-0227 
                   CVE-2015-0277 
=====================================================================

1. Summary:

Updated packages that provide Red Hat JBoss Enterprise Application Platform
6.4.0, and fix multiple security issues, several bugs, and add various
enhancements, are now available from the Red Hat Customer Portal.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

2. Description:

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java
applications based on JBoss Application Server 7.

It was found that a prior countermeasure in Apache WSS4J for
Bleichenbacher's attack on XML Encryption (CVE-2011-2487) threw an
exception that permitted an attacker to determine the failure of the
attempted attack, thereby leaving WSS4J vulnerable to the attack.
The original flaw allowed a remote attacker to recover the entire plain
text form of a symmetric key. (CVE-2015-0226)

A flaw was found in the way PicketLink's Service Provider and Identity
Provider handled certain requests. A remote attacker could use this flaw to
log to a victim's account via PicketLink. (CVE-2015-0277)

It was discovered that a JkUnmount rule for a subtree of a previous JkMount
rule could be ignored. This could allow a remote attacker to potentially
access a private artifact in a tree that would otherwise not be accessible
to them. (CVE-2014-8111)

It was discovered that OpenSSL would accept ephemeral RSA keys when using
non-export RSA cipher suites. A malicious server could make a TLS/SSL
client using OpenSSL use a weaker key exchange method. (CVE-2015-0204)

It was found that Apache WSS4J permitted bypass of the
requireSignedEncryptedDataElements configuration property via XML Signature
wrapping attacks. A remote attacker could use this flaw to modify the
contents of a signed request. (CVE-2015-0227)

It was found that OpenSSL's BigNumber Squaring implementation could produce
incorrect results under certain special conditions. This flaw could
possibly affect certain OpenSSL library functionality, such as RSA
blinding. Note that this issue occurred rarely and with a low probability,
and there is currently no known way of exploiting it. (CVE-2014-3570)

It was found that the Command Line Interface, as provided by Red Hat
Enterprise Application Platform, created a history file named
.jboss-cli-history in the user's home directory with insecure default file
permissions. This could allow a malicious local user to gain information
otherwise not accessible to them. (CVE-2014-3586)

The CVE-2015-0277 issue was discovered by Ondrej Kotek of Red Hat.

This release of JBoss Enterprise Application Platform also includes bug
fixes and enhancements. Documentation for these changes will be available
shortly from the JBoss Enterprise Application Platform 6.4.0 Release Notes,
linked to in the References.

All users of Red Hat JBoss Enterprise Application Platform 6.3 as provided
from the Red Hat Customer Portal are advised to apply this update.
The JBoss server process must be restarted for the update to take effect.

3. Solution:

The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing Red Hat JBoss Enterprise Application Platform installation and
deployed applications.

4. Bugs fixed (https://bugzilla.redhat.com/):

1126687 - CVE-2014-3586 JBoss AS CLI: Insecure default permissions on history file
1180184 - CVE-2015-0204 openssl: only allow ephemeral RSA keys in export ciphersuites (FREAK)
1180240 - CVE-2014-3570 openssl: Bignum squaring may produce incorrect results
1182591 - CVE-2014-8111 Tomcat mod_jk: information leak due to incorrect JkMount/JkUnmount directives processing
1191446 - CVE-2015-0226 wss4j: Apache WSS4J is vulnerable to Bleichenbacher's attack (incomplete fix for CVE-2011-2487)
1191451 - CVE-2015-0227 wss4j: Apache WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements property
1194832 - CVE-2015-0277 PicketLink: SP does not take Audience condition of a SAML assertion into account

5. References:

https://access.redhat.com/security/cve/CVE-2014-3570
https://access.redhat.com/security/cve/CVE-2014-3586
https://access.redhat.com/security/cve/CVE-2014-8111
https://access.redhat.com/security/cve/CVE-2015-0204
https://access.redhat.com/security/cve/CVE-2015-0226
https://access.redhat.com/security/cve/CVE-2015-0227
https://access.redhat.com/security/cve/CVE-2015-0277
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=appplatform&version=6.4
https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2015 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFVL+cgXlSAg2UNWIIRAgReAKCmbue7AHS0JviRhZ3Lf94SFWGFnwCeP1XZ
4LYefBygVEs7IHM2Q1P/dtg=
=lhOf
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce