seeing is believing

Red Hat Security Advisory 2013-0873-01

Red Hat Security Advisory 2013-0873-01
Posted May 28, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0873-01 - JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam. XML encryption backwards compatibility attacks were found against various frameworks, including Apache CXF. An attacker could force a server to use insecure, legacy cryptosystems, even when secure cryptosystems were enabled on endpoints. By forcing the use of legacy cryptosystems, flaws such as CVE-2011-1096 and CVE-2011-2487 would be exposed, allowing plain text to be recovered from cryptograms and symmetric keys. This issue affected both the JBoss Web Services CXF and JBoss Web Services Native stacks.

tags | advisory, java, web
systems | linux, redhat
advisories | CVE-2012-5575
MD5 | f3d0f9f6dd7593ba1360b0589ea65e34

Red Hat Security Advisory 2013-0873-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Important: JBoss Enterprise Application Platform 5.2.0 security update
Advisory ID: RHSA-2013:0873-01
Product: JBoss Enterprise Application Platform
Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-0873.html
Issue date: 2013-05-28
CVE Names: CVE-2012-5575
=====================================================================

1. Summary:

Updated packages for JBoss Enterprise Application Platform 5.2.0 which fix
one security issue are now available for Red Hat Enterprise Linux 4, 5,
and 6.

The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

2. Relevant releases/architectures:

JBoss Enterprise Application Platform 5 for RHEL 4 AS - noarch
JBoss Enterprise Application Platform 5 for RHEL 4 ES - noarch
JBoss Enterprise Application Platform 5 for RHEL 5 Server - noarch
JBoss Enterprise Application Platform 5 for RHEL 6 Server - noarch

3. Description:

JBoss Enterprise Application Platform is a platform for Java applications,
which integrates the JBoss Application Server with JBoss Hibernate and
JBoss Seam.

XML encryption backwards compatibility attacks were found against various
frameworks, including Apache CXF. An attacker could force a server to use
insecure, legacy cryptosystems, even when secure cryptosystems were enabled
on endpoints. By forcing the use of legacy cryptosystems, flaws such as
CVE-2011-1096 and CVE-2011-2487 would be exposed, allowing plain text to be
recovered from cryptograms and symmetric keys. This issue affected both the
JBoss Web Services CXF (jbossws-cxf) and JBoss Web Services Native
(jbossws-native) stacks. (CVE-2012-5575)

Red Hat would like to thank Tibor Jager, Kenneth G. Paterson and Juraj
Somorovsky of Ruhr-University Bochum for reporting this issue.

If you are using jbossws-cxf, then automatic checks to prevent this flaw
are only run when WS-SecurityPolicy is used to enforce security
requirements. It is best practice to use WS-SecurityPolicy to enforce
security requirements.

If you are using jbossws-native, the fix for this flaw is implemented by
two new configuration parameters in the 'encryption' element. This element
can be a child of 'requires' in both client and server wsse configuration
descriptors (set on a per-application basis via the application's
jboss-wsse-server.xml and jboss-wsse-client.xml files). The new attributes
are 'algorithms' and 'keyWrapAlgorithms'. These attributes should contain a
blank space or comma separated list of algorithm IDs that are allowed for
the encrypted incoming message, both for encryption and private key
wrapping. For backwards compatibility, no algorithm checks are performed by
default for empty lists or missing attributes.

For example (do not include the line break in your configuration):

encryption algorithms="aes-192-gcm aes-256-gcm"
keyWrapAlgorithms="rsa_oaep"

Specifies that incoming messages are required to be encrypted, and that the
only permitted encryption algorithms are AES-192 and 256 in GCM mode, and
RSA-OAEP only for key wrapping.

Before performing any decryption, the jbossws-native stack will verify that
each algorithm specified in the incoming messages is included in the
allowed algorithms lists from these new encryption element attributes. The
algorithm values to be used for 'algorithms' and 'keyWrapAlgorithms' are
the same as for 'algorithm' and 'keyWrapAlgorithm' in the 'encrypt'
element.

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of JBoss Enterprise Application Platform 5.2.0 on Red Hat
Enterprise Linux 4, 5, and 6 are advised to upgrade to these updated
packages. The JBoss server process must be restarted for the update to take
effect.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

5. Bugs fixed (http://bugzilla.redhat.com/):

880443 - CVE-2012-5575 jbossws-native, jbossws-cxf, apache-cxf: XML encryption backwards compatibility attacks

6. Package List:

JBoss Enterprise Application Platform 5 for RHEL 4 AS:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/apache-cxf-2.2.12-12.patch_07.ep5.el4.src.rpm
ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jbossws-3.1.2-14.SP15_patch_02.ep5.el4.src.rpm
ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/wss4j-1.5.12-6_patch_03.ep5.el4.src.rpm

noarch:
apache-cxf-2.2.12-12.patch_07.ep5.el4.noarch.rpm
jbossws-3.1.2-14.SP15_patch_02.ep5.el4.noarch.rpm
wss4j-1.5.12-6_patch_03.ep5.el4.noarch.rpm

JBoss Enterprise Application Platform 5 for RHEL 4 ES:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/apache-cxf-2.2.12-12.patch_07.ep5.el4.src.rpm
ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jbossws-3.1.2-14.SP15_patch_02.ep5.el4.src.rpm
ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/wss4j-1.5.12-6_patch_03.ep5.el4.src.rpm

noarch:
apache-cxf-2.2.12-12.patch_07.ep5.el4.noarch.rpm
jbossws-3.1.2-14.SP15_patch_02.ep5.el4.noarch.rpm
wss4j-1.5.12-6_patch_03.ep5.el4.noarch.rpm

JBoss Enterprise Application Platform 5 for RHEL 5 Server:

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/apache-cxf-2.2.12-12.patch_07.ep5.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossws-3.1.2-14.SP15_patch_02.ep5.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/wss4j-1.5.12-6_patch_03.ep5.el5.src.rpm

noarch:
apache-cxf-2.2.12-12.patch_07.ep5.el5.noarch.rpm
jbossws-3.1.2-14.SP15_patch_02.ep5.el5.noarch.rpm
wss4j-1.5.12-6_patch_03.ep5.el5.noarch.rpm

JBoss Enterprise Application Platform 5 for RHEL 6 Server:

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/apache-cxf-2.2.12-12.patch_07.ep5.el6.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jbossws-3.1.2-14.SP15_patch_02.ep5.el6.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/wss4j-1.5.12-6_patch_03.ep5.el6.src.rpm

noarch:
apache-cxf-2.2.12-12.patch_07.ep5.el6.noarch.rpm
jbossws-3.1.2-14.SP15_patch_02.ep5.el6.noarch.rpm
wss4j-1.5.12-6_patch_03.ep5.el6.noarch.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2012-5575.html
https://access.redhat.com/security/updates/classification/#important
http://ws.apache.org/wss4j/best_practice.html
http://cxf.apache.org/cve-2012-5575.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2013 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFRpO72XlSAg2UNWIIRAg6SAJ98q8sHWcmQDO/N0Gk3my43HBgUqgCeMKD/
vZuqul6GjKIzxuw+06zCTPo=
=1ZuP
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    7 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close