what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2014-0373-01

Red Hat Security Advisory 2014-0373-01
Posted Apr 3, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0373-01 - JBoss Web Server is an enterprise ready web server designed for medium and large applications, and is based on Tomcat. JBoss Web Server provides organizations with a single deployment platform for Java Server Pages and Java Servlet technologies, PHP, and CGI. It uses a genuine high performance hybrid technology that incorporates the best of the most recent OS technologies for processing high volume data, while keeping all the reference Java specifications. Apache Commons FileUpload package makes it easy to add robust, high-performance, file upload capability to servlets and web applications.

tags | advisory, java, web, cgi, php, file upload
systems | linux, redhat
advisories | CVE-2013-4286, CVE-2014-0050
SHA-256 | 2c709527d60e25bda2422d453c660f6900578eae1644bbfb89c6ec9545133888

Red Hat Security Advisory 2014-0373-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: Apache Commons Fileupload and JBoss Web security update
Advisory ID: RHSA-2014:0373-01
Product: Red Hat JBoss Middleware
Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0373.html
Issue date: 2014-04-03
CVE Names: CVE-2013-4286 CVE-2014-0050
=====================================================================

1. Summary:

An update for the Apache Commons Fileupload and JBoss Web components that
fixes two security issues is now available from the Red Hat Customer Portal
for Red Hat JBoss BRMS 6.0.1 and Red Hat JBoss BPM Suite 6.0.1.

The Red Hat Security Response Team has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Description:

JBoss Web Server is an enterprise ready web server designed for medium and
large applications, and is based on Tomcat. JBoss Web Server provides
organizations with a single deployment platform for Java Server Pages (JSP)
and Java Servlet technologies, PHP, and CGI. It uses a genuine high
performance hybrid technology that incorporates the best of the most recent
OS technologies for processing high volume data, while keeping all the
reference Java specifications.

Apache Commons FileUpload package makes it easy to add robust,
high-performance, file upload capability to servlets and web applications.

It was found that when JBoss Web processed a series of HTTP requests in
which at least one request contained either multiple content-length
headers, or one content-length header with a chunked transfer-encoding
header, JBoss Web would incorrectly handle the request. A remote attacker
could use this flaw to poison a web cache, perform cross-site scripting
(XSS) attacks, or obtain sensitive information from other requests.
(CVE-2013-4286)

A denial of service flaw was found in the way Apache Commons FileUpload,
which is embedded in the JBoss Web component of JBoss EAP bundled with
JBoss BRMS and BPM Suite, handled small-sized buffers used by
MultipartStream. A remote attacker could use this flaw to create a
malformed Content-Type header for a multipart request, causing JBoss Web to
enter an infinite loop when processing such an incoming request.
(CVE-2014-0050)

All users of the affected products as provided from the Red Hat Customer
Portal are advised to apply this update.

3. Solution:

The References section of this erratum contains download links (you must
log in to download the updates). Before applying the updates, back up
your existing installation, including all applications, configuration
files, databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application
Server process before installing this update, and then after installing the
update, restart the server by starting the JBoss Application Server
process.

4. Bugs fixed (https://bugzilla.redhat.com/):

1062337 - CVE-2014-0050 apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream
1069921 - CVE-2013-4286 tomcat: incomplete fix for CVE-2005-2090

5. References:

https://www.redhat.com/security/data/cve/CVE-2013-4286.html
https://www.redhat.com/security/data/cve/CVE-2014-0050.html
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms&downloadType=securityPatches&version=6.0.1
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite&downloadType=securityPatches&version=6.0.1

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2014 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFTPdmNXlSAg2UNWIIRAgR7AKCpF/GM0ZPGnl7kk1iEoAqsRnseKwCgvSWn
2LAP5hYcZ4D0KUr31fcButw=
=U9fo
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    9 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close