Red Hat JBoss Enterprise Application Platform 6.1.0 Security Update (RHSA-2013:1152)

2014-02-03T00:00:00
ID REDHAT-RHSA-2013-1152.NASL
Type nessus
Reporter This script is Copyright (C) 2014-2019 Tenable Network Security, Inc.
Modified 2014-02-03T00:00:00

Description

The version of JBoss Enterprise Application Platform running on the remote system is vulnerable to the following issues:

  • A flaw in the way authenticated connections are cached on the server by remote-naming could allow a remote attacker to log in as another user without knowing their password. (CVE-2013-4128)

  • A flaw in the way connections for remote EJB invocations via the EJB client API are cached on the server could allow a remote attacker to use an EJB client to log in as another user without knowing their password. (CVE-2013-4213)

                                        
                                            #TRUSTED a42789f1356d045eeec4d876f138429a2e3e3417204022b88eb7d563013624b0355fa542ee05449e316413614f205c3501a2c9a4bfc01081f90b036cb6fc6d475fea6c297dfa83e08f4c3c120b86d941bf46bf749dd2ebed7d9ad711820326fb5de503ac32cd71df7c74bc11d912f35e6b12482d4178f07d516ffe90e6e3ff00e0e1278f96ee84662216ecbc5f84dc306fb6f901d85bbecece8779bf2a61aa34a1339ec78db9a0be13bad62f059984245c57424f3e7290637dd588bef20db9181eea7abdbbf768114af7ac2b206c7726305af645456626595d1322d89e2b95cf1cacc625ed218a23b7548166e5d4f9504086fba5ed714e5ba31316e1418e7a435b688c55e8d3dfcd03c65d1fd50c17112606988a7d88756480fc288538eb19b379e6ec9e60a95f0787594b79568d92c4ccd7d2c6a93297cb644f3cfe66de85ddcb73ed42128f76455f96dd605e613e17023911ea6c6bc537cfa9ae3ada2c020199732e2f8ab4b600d8cf722ebafc710b00bec498de286c417764d17a09f35770daf17d4582976d92ccf81096bfde64143ea638f83b6253f7760650cbf148db0052ca8e0bcd5ef005283e2782a535f48cd296a5055e86d977e7d4037e078c734d25dc1eb12adb3f0d79b04009322cad6a39d0e4c2d37b9212f1458412c990de7d3fee3341014d6f00a32c10ed1245624c60f75728b651919c082d0d7060fb3091
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(72261);
  script_version("1.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2019/10/24");

  script_cve_id("CVE-2013-4128", "CVE-2013-4213");
  script_bugtraq_id(61739, 61742);
  script_xref(name:"RHSA", value:"2013:1152");

  script_name(english:"Red Hat JBoss Enterprise Application Platform 6.1.0 Security Update (RHSA-2013:1152)");
  script_summary(english:"Checks for the install versions of JBoss Enterprise Application Platform");

  script_set_attribute(attribute:"synopsis", value:"The remote Red Hat host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of JBoss Enterprise Application Platform running on the
remote system is vulnerable to the following issues:

  - A flaw in the way authenticated connections are cached
    on the server by remote-naming could allow a remote
    attacker to log in as another user without knowing
    their password. (CVE-2013-4128)

  - A flaw in the way connections for remote EJB
    invocations via the EJB client API are cached on the
    server could allow a remote attacker to use an EJB
    client to log in as another user without knowing their
    password. (CVE-2013-4213)");
  script_set_attribute(attribute:"see_also", value:"https://www.redhat.com/security/data/cve/CVE-2013-4128.html");
  script_set_attribute(attribute:"see_also", value:"https://www.redhat.com/security/data/cve/CVE-2013-4213.html");

  script_set_attribute(attribute:"solution", value:
"Apply the appropriate JBoss Enterprise Application Platform 6.1.0
security update.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/06/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2013/08/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/02/03");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:jboss_enterprise_application_platform:6.1.0");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Red Hat Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2014-2019 Tenable Network Security, Inc.");

  script_dependencies("ssh_get_info.nasl", "jboss_detect.nbin");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("ssh_func.inc");
include("telnet_func.inc");
include("hostlevel_funcs.inc");


if(sshlib::get_support_level() >= sshlib::SSH_LIB_SUPPORTS_COMMANDS)
  enable_ssh_wrappers();
else disable_ssh_wrappers();

# We are only interested in Red Hat systems
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
installs = get_kb_list_or_exit("Host/JBoss/EAP");

# We may support other protocols here
if ( islocalhost() )
{
 if ( ! defined_func("pread") ) exit(1, "'pread()' is not defined.");
 info_t = INFO_LOCAL;
}
else
{
 sock_g = ssh_open_connection();
 if (! sock_g) exit(1, "ssh_open_connection() failed.");
 info_t = INFO_SSH;
}

info = "";
jboss = 0;
if(!isnull(installs)) jboss = 1;

foreach install (make_list(installs))
{
  match = eregmatch(string:install, pattern:"([^:]+):(.*)");

  if (!isnull(match))
  {
    ver = match[1];
    path = match[2];

    # check for install version = 6.1.0
    if (ver =~ "^6.1.0([^0-9]|$)")
    {
      found = 0;
      cmd = 'test -f "' + path + 'modules/system/layers/base/org/jboss/remote-naming/main/jboss-remote-naming-1.0.6.Final-redhat-2.jar" && echo FOUND';
      buf = info_send_cmd(cmd:cmd);
      if ( (buf) && ("FOUND" >< buf) )
        found = 1;

      cmd = 'test -f "' + path + 'modules/system/layers/base/org/jboss/ejb-client/main/jboss-ejb-client-1.0.21.Final-redhat-1.jar" && echo FOUND';
      buf = info_send_cmd(cmd:cmd);
      if ( (buf) && ("FOUND" >< buf) )
        found = 1;

      if (found)
      {
        info += '\n' + '  Path    : ' + path+ '\n';
        info += '  Version : ' + ver + '\n';
      }
    }
  }
}
if (info_t == INFO_SSH) ssh_close_connection();

# Report what we found.
if (info)
{
  if (report_verbosity > 0)
  {
    if (max_index(split(info)) > 3) s = 's of JBoss Enterprise Application Platform are';
    else s = ' of JBoss Enterprise Application Platform is';

    report =
      '\n' +
      'The following instance'+s+' out of date and\nshould be patched or upgraded as appropriate :\n' +
      info;

    security_warning(port:0, extra:report);
  }
  else security_warning(port:0);
}
else if ( (!info) && (jboss) )
{
  exit(0, "The JBoss Enterprise Application Platform version installed is not affected.");
}
else audit(AUDIT_HOST_NOT, "affected");