what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2013-1369-01

Red Hat Security Advisory 2013-1369-01
Posted Sep 30, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-1369-01 - JBoss Remoting is a framework for building distributed applications in Java. A denial of service flaw was found in the implementation of the org.jboss.remoting.transport.socket.ServerThread class in JBoss Remoting. An attacker could use this flaw to exhaust all available file descriptors on the target server, preventing legitimate connections. Note that to exploit this flaw remotely, the remoting port must be exposed directly or indirectly.

tags | advisory, java, denial of service
systems | linux, redhat
advisories | CVE-2013-4210
SHA-256 | 5eae1344af2f036e1eb2cc5d11543dcc94f1bdc9e855ae032c89cbc1225c8e98

Red Hat Security Advisory 2013-1369-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: jboss-remoting security update
Advisory ID: RHSA-2013:1369-01
Product: Red Hat JBoss Enterprise Application Platform
Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-1369.html
Issue date: 2013-09-30
CVE Names: CVE-2013-4210
=====================================================================

1. Summary:

An updated jboss-remoting package that fixes one security issue is now
available for Red Hat JBoss Enterprise Application Platform 5.2.0 for Red
Hat Enterprise Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

2. Relevant releases/architectures:

Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS - noarch
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES - noarch
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server - noarch
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server - noarch

3. Description:

JBoss Remoting is a framework for building distributed applications in
Java.

A denial of service flaw was found in the implementation of the
org.jboss.remoting.transport.socket.ServerThread class in JBoss Remoting.
An attacker could use this flaw to exhaust all available file descriptors
on the target server, preventing legitimate connections. Note that to
exploit this flaw remotely, the remoting port must be exposed directly or
indirectly (for example, deploying a public facing application that uses
JBoss Remoting could indirectly expose this flaw). (CVE-2013-4210)

This issue was discovered by James Livingston of the Red Hat Support
Engineering Group.

Warning: Before applying this update, back up your existing Red Hat JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of Red Hat JBoss Enterprise Application Platform 5.2.0 on Red Hat
Enterprise Linux 4, 5, and 6 are advised to upgrade to this updated
package. The JBoss server process must be restarted for the update to take
effect.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

5. Bugs fixed (http://bugzilla.redhat.com/):

994321 - CVE-2013-4210 JBoss Remoting: DoS by file descriptor exhaustion

6. Package List:

Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/JBEAP/SRPMS/jboss-remoting-2.5.4-11.SP4_patch01.ep5.el4.src.rpm

noarch:
jboss-remoting-2.5.4-11.SP4_patch01.ep5.el4.noarch.rpm

Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/JBEAP/SRPMS/jboss-remoting-2.5.4-11.SP4_patch01.ep5.el4.src.rpm

noarch:
jboss-remoting-2.5.4-11.SP4_patch01.ep5.el4.noarch.rpm

Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server:

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-remoting-2.5.4-11.SP4_patch01.ep5.el5.src.rpm

noarch:
jboss-remoting-2.5.4-11.SP4_patch01.ep5.el5.noarch.rpm

Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server:

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/JBEAP/SRPMS/jboss-remoting-2.5.4-11.SP4_patch01.ep5.el6.src.rpm

noarch:
jboss-remoting-2.5.4-11.SP4_patch01.ep5.el6.noarch.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2013-4210.html
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2013 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFSSb1FXlSAg2UNWIIRAkuLAJ0fbFD/IOwlwRSwuMVG4BdJnEuQtACfQoZ1
CUpwM51vtBmIkFtyxhHYw34=
=yBc4
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    8 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    11 Files
  • 23
    Apr 23rd
    68 Files
  • 24
    Apr 24th
    23 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close