- Issued:
- 2013-02-26
- Updated:
- 2013-02-26
RHSA-2013:0569 - Important: JBoss Web Services security update
Synopsis
Important: JBoss Web Services security update
Type/Severity
Security Advisory Important
Topic
An update for the JBoss Web Services component in JBoss Enterprise SOA Platform 4.3 CP05 and JBoss Enterprise Portal Platform 4.3 CP07 which fixes one security issue is now available from the Red Hat Customer Portal.
The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Description
JBoss Enterprise SOA Platform is the next-generation ESB and business process automation infrastructure. JBoss Enterprise Portal Platform is the open source implementation of the Java EE suite of services and Portal services running atop JBoss Enterprise Application Platform.
An attack technique was found against the W3C XML Encryption Standard when block ciphers were used in cipher-block chaining (CBC) mode. A remote attacker could use this flaw to conduct chosen-ciphertext attacks, leading to the recovery of the entire plain text of a particular cryptogram by examining the differences between SOAP (Simple Object Access Protocol) responses sent from JBoss Web Services. (CVE-2011-1096)
Red Hat would like to thank Juraj Somorovsky of Ruhr-University Bochum for reporting this issue.
Note: Manual action is required to apply this update. The CVE-2011-1096 issue is an attack on the WS-Security standard itself. Using new Galois/Counter Mode (GCM) based algorithms for WS-Security encryption is the W3C suggested way of dealing with this issue. To use GCM algorithms in your application, update the encrypt element of all jboss-ws-security configuration to specify a GCM algorithm. The following is an example directive:
encrypt type="x509v3" algorithm="aes-128-gcm" alias="wsse"
Warning: Before applying this update, back up your JBoss installation, including any databases, database settings, applications, configuration files, and so on.
All users of JBoss Enterprise SOA Platform 4.3 CP05 and JBoss Enterprise Portal Platform 4.3 CP07 as provided from the Red Hat Customer Portal are advised to apply this update.
Solution
The References section of this erratum contains download links (you must log in to download the update). Before applying this update, back up your JBoss installation, including any databases, database settings, applications, configuration files, and so on.
For both JBoss Enterprise Portal Platform and JBoss Enterprise SOA Platform, it is recommended to halt the server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the server by starting the JBoss Application Server process.
Affected Products
| Product | Version | Arch |
|---|---|---|
| Red Hat JBoss Middleware | Text-Only Advisories | x86_64 |
Fixes
CVEs
References
- https://access.redhat.com/security/updates/classification/#important
- This content is not included.This content is not included.https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform&downloadType=securityPatches&version=4.3.0.GA_CP05
- This content is not included.This content is not included.https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal&downloadType=securityPatches&version=4.3+CP07
Additional information
- The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
- Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.