what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2013-0873-01

Red Hat Security Advisory 2013-0873-01
Posted May 28, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0873-01 - JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam. XML encryption backwards compatibility attacks were found against various frameworks, including Apache CXF. An attacker could force a server to use insecure, legacy cryptosystems, even when secure cryptosystems were enabled on endpoints. By forcing the use of legacy cryptosystems, flaws such as CVE-2011-1096 and CVE-2011-2487 would be exposed, allowing plain text to be recovered from cryptograms and symmetric keys. This issue affected both the JBoss Web Services CXF and JBoss Web Services Native stacks.

tags | advisory, java, web
systems | linux, redhat
advisories | CVE-2012-5575
SHA-256 | cecf1d51ed0c4262624e43b997afb2de10d940cea27df60955ecbe489b38f371

Red Hat Security Advisory 2013-0873-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Important: JBoss Enterprise Application Platform 5.2.0 security update
Advisory ID: RHSA-2013:0873-01
Product: JBoss Enterprise Application Platform
Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-0873.html
Issue date: 2013-05-28
CVE Names: CVE-2012-5575
=====================================================================

1. Summary:

Updated packages for JBoss Enterprise Application Platform 5.2.0 which fix
one security issue are now available for Red Hat Enterprise Linux 4, 5,
and 6.

The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

2. Relevant releases/architectures:

JBoss Enterprise Application Platform 5 for RHEL 4 AS - noarch
JBoss Enterprise Application Platform 5 for RHEL 4 ES - noarch
JBoss Enterprise Application Platform 5 for RHEL 5 Server - noarch
JBoss Enterprise Application Platform 5 for RHEL 6 Server - noarch

3. Description:

JBoss Enterprise Application Platform is a platform for Java applications,
which integrates the JBoss Application Server with JBoss Hibernate and
JBoss Seam.

XML encryption backwards compatibility attacks were found against various
frameworks, including Apache CXF. An attacker could force a server to use
insecure, legacy cryptosystems, even when secure cryptosystems were enabled
on endpoints. By forcing the use of legacy cryptosystems, flaws such as
CVE-2011-1096 and CVE-2011-2487 would be exposed, allowing plain text to be
recovered from cryptograms and symmetric keys. This issue affected both the
JBoss Web Services CXF (jbossws-cxf) and JBoss Web Services Native
(jbossws-native) stacks. (CVE-2012-5575)

Red Hat would like to thank Tibor Jager, Kenneth G. Paterson and Juraj
Somorovsky of Ruhr-University Bochum for reporting this issue.

If you are using jbossws-cxf, then automatic checks to prevent this flaw
are only run when WS-SecurityPolicy is used to enforce security
requirements. It is best practice to use WS-SecurityPolicy to enforce
security requirements.

If you are using jbossws-native, the fix for this flaw is implemented by
two new configuration parameters in the 'encryption' element. This element
can be a child of 'requires' in both client and server wsse configuration
descriptors (set on a per-application basis via the application's
jboss-wsse-server.xml and jboss-wsse-client.xml files). The new attributes
are 'algorithms' and 'keyWrapAlgorithms'. These attributes should contain a
blank space or comma separated list of algorithm IDs that are allowed for
the encrypted incoming message, both for encryption and private key
wrapping. For backwards compatibility, no algorithm checks are performed by
default for empty lists or missing attributes.

For example (do not include the line break in your configuration):

encryption algorithms="aes-192-gcm aes-256-gcm"
keyWrapAlgorithms="rsa_oaep"

Specifies that incoming messages are required to be encrypted, and that the
only permitted encryption algorithms are AES-192 and 256 in GCM mode, and
RSA-OAEP only for key wrapping.

Before performing any decryption, the jbossws-native stack will verify that
each algorithm specified in the incoming messages is included in the
allowed algorithms lists from these new encryption element attributes. The
algorithm values to be used for 'algorithms' and 'keyWrapAlgorithms' are
the same as for 'algorithm' and 'keyWrapAlgorithm' in the 'encrypt'
element.

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of JBoss Enterprise Application Platform 5.2.0 on Red Hat
Enterprise Linux 4, 5, and 6 are advised to upgrade to these updated
packages. The JBoss server process must be restarted for the update to take
effect.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

5. Bugs fixed (http://bugzilla.redhat.com/):

880443 - CVE-2012-5575 jbossws-native, jbossws-cxf, apache-cxf: XML encryption backwards compatibility attacks

6. Package List:

JBoss Enterprise Application Platform 5 for RHEL 4 AS:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/apache-cxf-2.2.12-12.patch_07.ep5.el4.src.rpm
ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jbossws-3.1.2-14.SP15_patch_02.ep5.el4.src.rpm
ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/wss4j-1.5.12-6_patch_03.ep5.el4.src.rpm

noarch:
apache-cxf-2.2.12-12.patch_07.ep5.el4.noarch.rpm
jbossws-3.1.2-14.SP15_patch_02.ep5.el4.noarch.rpm
wss4j-1.5.12-6_patch_03.ep5.el4.noarch.rpm

JBoss Enterprise Application Platform 5 for RHEL 4 ES:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/apache-cxf-2.2.12-12.patch_07.ep5.el4.src.rpm
ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jbossws-3.1.2-14.SP15_patch_02.ep5.el4.src.rpm
ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/wss4j-1.5.12-6_patch_03.ep5.el4.src.rpm

noarch:
apache-cxf-2.2.12-12.patch_07.ep5.el4.noarch.rpm
jbossws-3.1.2-14.SP15_patch_02.ep5.el4.noarch.rpm
wss4j-1.5.12-6_patch_03.ep5.el4.noarch.rpm

JBoss Enterprise Application Platform 5 for RHEL 5 Server:

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/apache-cxf-2.2.12-12.patch_07.ep5.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossws-3.1.2-14.SP15_patch_02.ep5.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/wss4j-1.5.12-6_patch_03.ep5.el5.src.rpm

noarch:
apache-cxf-2.2.12-12.patch_07.ep5.el5.noarch.rpm
jbossws-3.1.2-14.SP15_patch_02.ep5.el5.noarch.rpm
wss4j-1.5.12-6_patch_03.ep5.el5.noarch.rpm

JBoss Enterprise Application Platform 5 for RHEL 6 Server:

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/apache-cxf-2.2.12-12.patch_07.ep5.el6.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jbossws-3.1.2-14.SP15_patch_02.ep5.el6.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/wss4j-1.5.12-6_patch_03.ep5.el6.src.rpm

noarch:
apache-cxf-2.2.12-12.patch_07.ep5.el6.noarch.rpm
jbossws-3.1.2-14.SP15_patch_02.ep5.el6.noarch.rpm
wss4j-1.5.12-6_patch_03.ep5.el6.noarch.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2012-5575.html
https://access.redhat.com/security/updates/classification/#important
http://ws.apache.org/wss4j/best_practice.html
http://cxf.apache.org/cve-2012-5575.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2013 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFRpO72XlSAg2UNWIIRAg6SAJ98q8sHWcmQDO/N0Gk3my43HBgUqgCeMKD/
vZuqul6GjKIzxuw+06zCTPo=
=1ZuP
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close