Red Hat JBoss Enterprise Application Platform 6.1.0 Security Update (RHSA-2013:1152)

2014-02-03T00:00:00
ID REDHAT-RHSA-2013-1152.NASL
Type nessus
Reporter Tenable
Modified 2018-07-26T00:00:00

Description

The version of JBoss Enterprise Application Platform running on the remote system is vulnerable to the following issues:

  • A flaw in the way authenticated connections are cached on the server by remote-naming could allow a remote attacker to log in as another user without knowing their password. (CVE-2013-4128)

  • A flaw in the way connections for remote EJB invocations via the EJB client API are cached on the server could allow a remote attacker to use an EJB client to log in as another user without knowing their password. (CVE-2013-4213)

                                        
                                            #TRUSTED 953907d4344500535d253c756ec6343b5a92aca6a413dec3843f8afc9eeb5285c5f937c0ba121644be6d82a89a3a96e1836dbe4889e35e7a8193f4492aae61231922fda3e57fb7f15bbc71e08c5624b8ebefcdb65450841da9f937a8b71c781911adcdef5195c070a0e08a63e1b91808821364d03d4b6b4c84a8de8c11b5dbe6b3930ecc8976e1407326a3048cc0a17ea8ec5ede0bbe594df60f0c89a41b55a4f38d9a1dfaa2cf96f3e38c90d2bdb6ed192259ea254779437626d2c8e22dd3e74c2076807502db47d041dcf06752c8f5cb59788e12038e989090fa39fd228c0217088bc4e7ea6c321f624dc23bae7911546eb8a5b514a0dd2e88ae359c77ae5a0b4e7e2a913ce42865e50e275ffa007409bc38524a92239184a419f1ba4c57094401e512e032518a7352906964daf13976da7c170f76901d347f0efc0338cacc51a1464bb32d484fdba3bb4f251b5fb3ded064a5304f04c1e0b6c7ddabfdf8aa19f62c141b9d2d231306473806acf5d95e6f1c6e3f78f8750e6edeffc47059fffe4abe8bd5c8ae36f64efee544b511bc5b9d37b44dce7d1c48950ea657c7b4409cf5bd5ea31cbf12a85ed410da3cc16f0fafffd6256e12f08bfefd80f220eb01d17be98e4866864e063dfe179482549523877c1e2a97436ba765804eab8d158a0c77474c230d38a5f8e7f2d9fff94b1596f96753ed9901a513521d04f66fc15c
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(72261);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2018/07/26");

  script_cve_id("CVE-2013-4128", "CVE-2013-4213");
  script_bugtraq_id(61739, 61742);
  script_xref(name:"RHSA", value:"2013:1152");

  script_name(english:"Red Hat JBoss Enterprise Application Platform 6.1.0 Security Update (RHSA-2013:1152)");
  script_summary(english:"Checks for the install versions of JBoss Enterprise Application Platform");

  script_set_attribute(attribute:"synopsis", value:"The remote Red Hat host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of JBoss Enterprise Application Platform running on the
remote system is vulnerable to the following issues:

  - A flaw in the way authenticated connections are cached
    on the server by remote-naming could allow a remote
    attacker to log in as another user without knowing
    their password. (CVE-2013-4128)

  - A flaw in the way connections for remote EJB
    invocations via the EJB client API are cached on the
    server could allow a remote attacker to use an EJB
    client to log in as another user without knowing their
    password. (CVE-2013-4213)");
  script_set_attribute(attribute:"see_also", value:"https://www.redhat.com/security/data/cve/CVE-2013-4128.html");
  script_set_attribute(attribute:"see_also", value:"https://www.redhat.com/security/data/cve/CVE-2013-4213.html");

  script_set_attribute(attribute:"solution", value:
"Apply the appropriate JBoss Enterprise Application Platform 6.1.0
security update.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/06/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2013/08/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/02/03");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:jboss_enterprise_application_platform:6.1.0");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Red Hat Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.");

  script_dependencies("ssh_get_info.nasl", "jboss_detect.nbin");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("ssh_func.inc");
include("telnet_func.inc");
include("hostlevel_funcs.inc");


if(sshlib::get_support_level() >= sshlib::SSH_LIB_SUPPORTS_COMMANDS)
  enable_ssh_wrappers();
else disable_ssh_wrappers();

# We are only interested in Red Hat systems
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
installs = get_kb_list_or_exit("Host/JBoss/EAP");

# We may support other protocols here
if ( islocalhost() )
{
 if ( ! defined_func("pread") ) exit(1, "'pread()' is not defined.");
 info_t = INFO_LOCAL;
}
else
{
 sock_g = ssh_open_connection();
 if (! sock_g) exit(1, "ssh_open_connection() failed.");
 info_t = INFO_SSH;
}

info = "";
jboss = 0;
if(!isnull(installs)) jboss = 1;

foreach install (make_list(installs))
{
  match = eregmatch(string:install, pattern:"([^:]+):(.*)");

  if (!isnull(match))
  {
    ver = match[1];
    path = match[2];

    # check for install version = 6.1.0
    if (ver =~ "^6.1.0([^0-9]|$)")
    {
      found = 0;
      cmd = 'test -f "' + path + 'modules/system/layers/base/org/jboss/remote-naming/main/jboss-remote-naming-1.0.6.Final-redhat-2.jar" && echo FOUND';
      buf = info_send_cmd(cmd:cmd);
      if ( (buf) && ("FOUND" >< buf) )
        found = 1;

      cmd = 'test -f "' + path + 'modules/system/layers/base/org/jboss/ejb-client/main/jboss-ejb-client-1.0.21.Final-redhat-1.jar" && echo FOUND';
      buf = info_send_cmd(cmd:cmd);
      if ( (buf) && ("FOUND" >< buf) )
        found = 1;

      if (found)
      {
        info += '\n' + '  Path    : ' + path+ '\n';
        info += '  Version : ' + ver + '\n';
      }
    }
  }
}
if (info_t == INFO_SSH) ssh_close_connection();

# Report what we found.
if (info)
{
  if (report_verbosity > 0)
  {
    if (max_index(split(info)) > 3) s = 's of JBoss Enterprise Application Platform are';
    else s = ' of JBoss Enterprise Application Platform is';

    report =
      '\n' +
      'The following instance'+s+' out of date and\nshould be patched or upgraded as appropriate :\n' +
      info;

    security_warning(port:0, extra:report);
  }
  else security_warning(port:0);
}
else if ( (!info) && (jboss) )
{
  exit(0, "The JBoss Enterprise Application Platform version installed is not affected.");
}
else audit(AUDIT_HOST_NOT, "affected");