Issued:
2013-05-28
Updated:
2013-05-28

RHSA-2013:0873 - Important: JBoss Enterprise Application Platform 5.2.0 security update

Synopsis

Important: JBoss Enterprise Application Platform 5.2.0 security update

Type/Severity

Security Advisory Important

Topic

Updated packages for JBoss Enterprise Application Platform 5.2.0 which fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Description

JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam.

XML encryption backwards compatibility attacks were found against various frameworks, including Apache CXF. An attacker could force a server to use insecure, legacy cryptosystems, even when secure cryptosystems were enabled on endpoints. By forcing the use of legacy cryptosystems, flaws such as CVE-2011-1096 and CVE-2011-2487 would be exposed, allowing plain text to be recovered from cryptograms and symmetric keys. This issue affected both the JBoss Web Services CXF (jbossws-cxf) and JBoss Web Services Native (jbossws-native) stacks. (CVE-2012-5575)

Red Hat would like to thank Tibor Jager, Kenneth G. Paterson and Juraj Somorovsky of Ruhr-University Bochum for reporting this issue.

If you are using jbossws-cxf, then automatic checks to prevent this flaw are only run when WS-SecurityPolicy is used to enforce security requirements. It is best practice to use WS-SecurityPolicy to enforce security requirements.

If you are using jbossws-native, the fix for this flaw is implemented by two new configuration parameters in the 'encryption' element. This element can be a child of 'requires' in both client and server wsse configuration descriptors (set on a per-application basis via the application's jboss-wsse-server.xml and jboss-wsse-client.xml files). The new attributes are 'algorithms' and 'keyWrapAlgorithms'. These attributes should contain a blank space or comma separated list of algorithm IDs that are allowed for the encrypted incoming message, both for encryption and private key wrapping. For backwards compatibility, no algorithm checks are performed by default for empty lists or missing attributes.

For example (do not include the line break in your configuration):

encryption algorithms="aes-192-gcm aes-256-gcm" keyWrapAlgorithms="rsa_oaep"

Specifies that incoming messages are required to be encrypted, and that the only permitted encryption algorithms are AES-192 and 256 in GCM mode, and RSA-OAEP only for key wrapping.

Before performing any decryption, the jbossws-native stack will verify that each algorithm specified in the incoming messages is included in the allowed algorithms lists from these new encryption element attributes. The algorithm values to be used for 'algorithms' and 'keyWrapAlgorithms' are the same as for 'algorithm' and 'keyWrapAlgorithm' in the 'encrypt' element.

Warning: Before applying this update, back up your existing JBoss Enterprise Application Platform installation (including all applications and configuration files).

All users of JBoss Enterprise Application Platform 5.2.0 on Red Hat Enterprise Linux 4, 5, and 6 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258

Affected Products

ProductVersionArch
JBoss Enterprise Application Platform5x86_64
JBoss Enterprise Application Platform5x86_64
JBoss Enterprise Application Platform5i386
JBoss Enterprise Application Platform5i386
JBoss Enterprise Application Platform from RHUI5x86_64
JBoss Enterprise Application Platform from RHUI5i386

Updated Packages

  • jbossws-3.1.2-14.SP15_patch_02.ep5.el6.noarch.rpm
  • wss4j-1.5.12-6_patch_03.ep5.el6.src.rpm
  • jbossws-3.1.2-14.SP15_patch_02.ep5.el5.src.rpm
  • wss4j-1.5.12-6_patch_03.ep5.el5.src.rpm
  • jbossws-3.1.2-14.SP15_patch_02.ep5.el5.noarch.rpm
  • wss4j-1.5.12-6_patch_03.ep5.el5.noarch.rpm
  • apache-cxf-2.2.12-12.patch_07.ep5.el5.noarch.rpm
  • apache-cxf-2.2.12-12.patch_07.ep5.el5.src.rpm
  • apache-cxf-2.2.12-12.patch_07.ep5.el6.src.rpm
  • apache-cxf-2.2.12-12.patch_07.ep5.el6.noarch.rpm
  • jbossws-3.1.2-14.SP15_patch_02.ep5.el6.src.rpm
  • wss4j-1.5.12-6_patch_03.ep5.el6.noarch.rpm

Fixes

CVEs

References

Additional information