Issued:
2010-02-23
Updated:
2010-02-23

RHSA-2010:0119 - Low: JBoss Enterprise Web Server 1.0.1 update

Synopsis

Low: JBoss Enterprise Web Server 1.0.1 update

Type/Severity

Security Advisory Low

Topic

JBoss Enterprise Web Server 1.0.1 is now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Description

JBoss Enterprise Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the industry's leading web server (Apache HTTP Server), the popular Apache Tomcat servlet container, as well as the mod_jk connector and the Tomcat Native library.

This 1.0.1 release of JBoss Enterprise Web Server serves as a replacement to JBoss Enterprise Web Server 1.0.0 GA. These updated packages include a number of bug fixes. For detailed component, installation, and bug fix information, refer to the JBoss Enterprise Web Server 1.0.1 Release Notes, available shortly from the link in the References section of this erratum.

The following security issues are also fixed with this release:

A directory traversal flaw was found in the Tomcat deployment process. An attacker could create a specially-crafted WAR file, which once deployed by a local, unsuspecting user, would lead to attacker-controlled content being deployed outside of the web root, into directories accessible to the Tomcat process. (CVE-2009-2693)

A second directory traversal flaw was found in the Tomcat deployment process. WAR file names were not sanitized, which could allow an attacker to create a specially-crafted WAR file that could delete files in the Tomcat host's work directory. (CVE-2009-2902)

A flaw was found in the way the TLS/SSL (Transport Layer Security/Secure Sockets Layer) protocols handle session renegotiation. A man-in-the-middle attacker could use this flaw to prefix arbitrary plain text to a client's session (for example, an HTTPS connection to a website). This could force the server to process an attacker's request as if authenticated using the victim's credentials. (CVE-2009-3555)

This update provides a mitigation for this flaw in the following components:

tomcat5 and tomcat6: A new attribute, allowUnsafeLegacyRenegotiation, is available for the blocking IO (BIO) connector using JSSE, to enable or disable TLS session renegotiation. The default value is "false", meaning session renegotiation, both client- and server-initiated, is disabled by default.

tomcat-native: Client-initiated renegotiation is now rejected by the native connector. Server-initiated renegotiation is still allowed.

Refer to the following Knowledgebase article for additional details about the CVE-2009-3555 flaw: http://kbase.redhat.com/faq/docs/DOC-20491

All users of JBoss Enterprise Web Server 1.0.0 on Red Hat Enterprise Linux 4 and 5 are advised to upgrade to these updated packages.

Solution

Before applying this update, make sure that all previously-released errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at This content is not included.http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

ProductVersionArch
JBoss Enterprise Web Server1x86_64
JBoss Enterprise Web Server1i386

Updated Packages

  • tomcat5-common-lib-5.5.28-7.1.ep5.el5.noarch.rpm
  • tomcat5-jsp-2.0-api-javadoc-5.5.28-7.1.ep5.el5.noarch.rpm
  • glassfish-jsf-1.2_13-3.ep5.el5.src.rpm
  • jakarta-commons-io-1.4-1.1.ep5.el5.noarch.rpm
  • mod_jk-1.2.28-4.1.ep5.el5.src.rpm
  • tomcat5-5.5.28-7.1.ep5.el5.src.rpm
  • mod_jk-ap20-1.2.28-4.1.ep5.el5.x86_64.rpm
  • tomcat5-servlet-2.4-api-javadoc-5.5.28-7.1.ep5.el5.noarch.rpm
  • mod_ssl-2.2.14-1.2.1.ep5.el5.i386.rpm
  • httpd-devel-2.2.14-1.2.1.ep5.el5.i386.rpm
  • tomcat6-6.0.24-2.1.ep5.el5.src.rpm
  • mod_jk-manual-1.2.28-4.1.ep5.el5.x86_64.rpm
  • tomcat6-log4j-6.0.24-2.1.ep5.el5.noarch.rpm
  • tomcat6-lib-6.0.24-2.1.ep5.el5.noarch.rpm
  • tomcat6-javadoc-6.0.24-2.1.ep5.el5.noarch.rpm
  • httpd-devel-2.2.14-1.2.1.ep5.el5.x86_64.rpm
  • struts12-1.2.9-2.ep5.el5.noarch.rpm
  • tomcat6-jsp-2.1-api-6.0.24-2.1.ep5.el5.noarch.rpm
  • jakarta-oro-2.0.8-3.1.ep5.el5.noarch.rpm
  • tomcat6-6.0.24-2.1.ep5.el5.noarch.rpm
  • jakarta-oro-2.0.8-3.1.ep5.el5.src.rpm
  • httpd-2.2.14-1.2.1.ep5.el5.x86_64.rpm
  • tomcat5-server-lib-5.5.28-7.1.ep5.el5.noarch.rpm
  • struts12-1.2.9-2.ep5.el5.src.rpm
  • tomcat5-jsp-2.0-api-5.5.28-7.1.ep5.el5.noarch.rpm
  • httpd-2.2.14-1.2.1.ep5.el5.src.rpm
  • tomcat5-5.5.28-7.1.ep5.el5.noarch.rpm
  • jakarta-commons-chain-1.2-2.1.1.ep5.el5.src.rpm
  • tomcat-native-1.1.19-2.0.1.ep5.el5.src.rpm
  • tomcat5-servlet-2.4-api-5.5.28-7.1.ep5.el5.noarch.rpm
  • tomcat-native-1.1.19-2.0.1.ep5.el5.x86_64.rpm
  • httpd-2.2.14-1.2.1.ep5.el5.i386.rpm
  • tomcat-native-1.1.19-2.0.1.ep5.el5.i386.rpm
  • tomcat5-jasper-eclipse-5.5.28-7.1.ep5.el5.noarch.rpm
  • jakarta-commons-io-1.4-1.1.ep5.el5.src.rpm
  • mod_jk-ap20-1.2.28-4.1.ep5.el5.i386.rpm
  • tomcat6-docs-webapp-6.0.24-2.1.ep5.el5.noarch.rpm
  • tomcat6-admin-webapps-6.0.24-2.1.ep5.el5.noarch.rpm
  • tomcat5-admin-webapps-5.5.28-7.1.ep5.el5.noarch.rpm
  • glassfish-jsf-1.2_13-3.ep5.el5.noarch.rpm
  • httpd-manual-2.2.14-1.2.1.ep5.el5.x86_64.rpm
  • mod_jk-manual-1.2.28-4.1.ep5.el5.i386.rpm
  • httpd-manual-2.2.14-1.2.1.ep5.el5.i386.rpm
  • tomcat6-webapps-6.0.24-2.1.ep5.el5.noarch.rpm
  • tomcat6-el-1.0-api-6.0.24-2.1.ep5.el5.noarch.rpm
  • jakarta-commons-chain-1.2-2.1.1.ep5.el5.noarch.rpm
  • tomcat5-parent-5.5.28-7.1.ep5.el5.noarch.rpm
  • tomcat6-servlet-2.5-api-6.0.24-2.1.ep5.el5.noarch.rpm
  • tomcat5-jasper-5.5.28-7.1.ep5.el5.noarch.rpm
  • tomcat5-jasper-javadoc-5.5.28-7.1.ep5.el5.noarch.rpm
  • tomcat5-webapps-5.5.28-7.1.ep5.el5.noarch.rpm
  • mod_ssl-2.2.14-1.2.1.ep5.el5.x86_64.rpm

Fixes

CVEs

References

Additional information