-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat JBoss BPM Suite security update
Advisory ID:       RHSA-2017:0557-01
Product:           Red Hat JBoss BPM Suite
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2017-0557.html
Issue date:        2017-03-16
CVE Names:         CVE-2016-6343 CVE-2016-7034 CVE-2017-2658 
=====================================================================

1. Summary:

An update is now available for Red Hat JBoss BPM Suite.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat JBoss BPM Suite is a business rules and processes management system
for the management, storage, creation, modification, and deployment of
JBoss rules and BPMN2-compliant business processes.

This release of Red Hat JBoss BPM Suite 6.4.2 serves as a replacement for
Red Hat JBoss BPM Suite 6.4.1, and includes bug fixes and enhancements,
which are documented in the Release Notes document linked to in the
References.

Security Fix(es):

* JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder.
Remote attackers can entice authenticated users that have privileges to
access dashbuilder (usually admins) to click on links to
/dashbuilder/Controller containing malicious scripts. Successful
exploitation would allow execution of script code within the context of the
affected user. (CVE-2016-6343)

* It has been reported that CSRF tokens are not properly handled in JBoss
BPM suite dashbuilder. Old tokens generated during an active session can be
used to bypass CSRF protection. In addition, the tokens are sent in query
string so they can be exposed through the browser's history, referrers, web
logs, and other sources. Attackers may be able to obtain old tokens from
various sources in the network and perform CSRF attacks successfully.
(CVE-2016-7034)

* It was discovered that the Dashbuilder login page could be opened in an
IFRAME, which made it possible to intercept and manipulate requests. An
attacker could use this flaw to trick a user into performing arbitrary
actions in the Console (clickjacking). (CVE-2017-2658)

The CVE-2016-6343 and CVE-2016-7034 issues were discovered by Jeremy Choi
(Red Hat Product Security Team) and the CVE-2017-2658 issue was discovered
by Martin Weiler (Red Hat).

3. Solution:

Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.

It is recommended to halt the server by stopping the JBoss Application
Server process before installing this update; after installing the update,
restart the server by starting the JBoss Application Server process.

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1371801 - CVE-2016-6343 JBoss bpms 6.3.x reflected XSS in dashbuilder
1373347 - CVE-2016-7034 JBoss bpms: insecure handling CSRF token in dashbuilder
1433087 - CVE-2017-2658 Dashbuilder: Lack of clickjacking protection on the login page

5. References:

https://access.redhat.com/security/cve/CVE-2016-6343
https://access.redhat.com/security/cve/CVE-2016-7034
https://access.redhat.com/security/cve/CVE-2017-2658
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite&downloadType=securityPatches&version=6.4

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2017 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFYyv83XlSAg2UNWIIRAugJAJ487WHaJsX+FzSyxeFG1yInlCdlhgCgnInJ
5fHjZf+XyzP950TPuQi4V8s=
=9rzp
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce