Issued:
2016-07-27
Updated:
2016-07-27

RHSA-2016:1519 - Critical: Red Hat JBoss Operations Network 3.3.6 update

Synopsis

Critical: Red Hat JBoss Operations Network 3.3.6 update

Type/Severity

Security Advisory Critical

Topic

Red Hat JBoss Operations Network 3.3 update 6, which fixes two security issues and several bugs, is now available from the Red Hat Customer Portal.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

[Updated August 25, 2016] This advisory described the CVE-2016-3737 flaw in a way which implied the issue was addressed via a code fix included in this erratum. However, the issue was actually addressed by updating the JON installation guide to document configuration changes that need to be applied manually to mitigate the issue. Refer to the Solution text below, and the Knowledgebase Article in the References section for further details.

Description

Red Hat JBoss Operations Network is a Middleware management solution that provides a single point of control to deploy, manage, and monitor JBoss Enterprise Middleware, applications, and services.

This JBoss Operations Network 3.3.6 release serves as a replacement for JBoss Operations Network 3.3.5, and includes several bug fixes. Refer to the Customer Portal page linked in the References section for information on the most significant of these changes.

The following security issues are also fixed with this release:

It was discovered that sending specially crafted HTTP request to the JON server would allow deserialization of that message without authentication. An attacker could use this flaw to cause remote code execution. (CVE-2016-3737)

It was discovered that sending requests containing large headers to the Web Console produced a Java OutOfMemoryError in the HTTP management interface. An attacker could use this flaw to cause a denial of service. (CVE-2015-5220)

A padding oracle flaw was found in the Secure Sockets Layer version 2.0 (SSLv2) protocol. An attacker could potentially use this flaw to decrypt RSA-encrypted cipher text from a connection using a newer SSL/TLS protocol version, allowing them to decrypt such connections. This cross-protocol attack is publicly referred to as DROWN. (CVE-2016-0800)

All users of JBoss Operations Network 3.3.5, as provided from the Red Hat Customer Portal, are advised to upgrade to JBoss Operations Network 3.3.6.

Solution

The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing JBoss Operations Network installation (including its databases, applications, configuration files, the JBoss Operations Network server's file system directory, and so on).

Refer to the JBoss Operations Network 3.3.6 Release Notes for installation information.

To mitigate CVE-2016-3737 you need to manually configure JON to use SSL client authentication between servers and agents. Detailed instructions can be found in the "Setting up Client Authentication Between Servers and Agents" section of the "Configuring JON Servers and Agents" guide linked to in the References section.

Affected Products

ProductVersionArch
Red Hat JBoss MiddlewareText-Only Advisoriesx86_64

Fixes

CVEs

References

Additional information