Issued:

2013-01-10

Updated:

2013-01-10

RHSA-2013:0151 - Important: JBoss Enterprise Portal Platform 4.3 CP07 security update

Synopsis

Important: JBoss Enterprise Portal Platform 4.3 CP07 security update

Type/Severity

Security Advisory Important

Topic

An update for JBoss Enterprise Portal Platform 4.3 CP07 that fixes one security issue is now available from the Red Hat Customer Portal.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Description

JBoss Enterprise Portal Platform is the open source implementation of the Java EE suite of services and Portal services running atop JBoss Enterprise Application Platform. It comprises a set of offerings for enterprise customers who are looking for pre-configured profiles of JBoss Enterprise Middleware components that have been tested and certified together to provide an integrated experience.

It was found that when an application used FORM authentication, along with another component that calls request.setUserPrincipal() before the call to FormAuthenticator#authenticate() (such as the Single-Sign-On valve), it was possible to bypass the security constraint checks in the FORM authenticator by appending "/j_security_check" to the end of a URL. A remote attacker with an authenticated session on an affected application could use this flaw to circumvent authorization controls, and thereby access resources not permitted by the roles associated with their authenticated session. (CVE-2012-3546)

Warning: Before applying this update, back up all applications deployed on JBoss Enterprise Portal Platform, along with all customized configuration files, and any databases and database settings.

All users of JBoss Enterprise Portal Platform 4.3 CP07 as provided from the Red Hat Customer Portal are advised to apply this update.

Solution

The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up all applications deployed on JBoss Enterprise Portal Platform, along with all customized configuration files, and any databases and database settings.

Note that it is recommended to halt the JBoss Enterprise Portal Platform server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the JBoss Enterprise Portal Platform server by starting the JBoss Application Server process.

Affected Products

Fixes

• This content is not included.BZ - 883634

CVEs

• CVE-2012-3546

References

• https://access.redhat.com/security/updates/classification/#important
• This content is not included.This content is not included.https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal&downloadType=securityPatches&version=4.3+CP07
• Content from tomcat.apache.org is not included.Content from tomcat.apache.org is not included.http://tomcat.apache.org/security-6.html

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.