(RHSA-2013:0261) Important: JBoss Enterprise Application Platform 4.3.0 CP10 security update

2013-02-14T05:00:00
ID RHSA-2013:0261
Type redhat
Reporter RedHat
Modified 2017-07-25T00:07:11

Description

JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam.

An attack technique was found against the W3C XML Encryption Standard when block ciphers were used in cipher-block chaining (CBC) mode. A remote attacker could use this flaw to conduct chosen-ciphertext attacks, leading to the recovery of the entire plain text of a particular cryptogram by examining the differences between SOAP (Simple Object Access Protocol) responses sent from JBoss Web Services. (CVE-2011-1096)

Red Hat would like to thank Juraj Somorovsky of Ruhr-University Bochum for reporting this issue.

Note: Manual action is required to apply this update. The CVE-2011-1096 issue is an attack on the WS-Security standard itself. Using new Galois/Counter Mode (GCM) based algorithms for WS-Security encryption is the W3C suggested way of dealing with this issue. To use GCM algorithms in your application, update the encrypt element of all jboss-ws-security configuration to specify a GCM algorithm. The following is an example directive:

encrypt type="x509v3" algorithm="aes-128-gcm" alias="wsse"

Warning: Before applying this update, back up your existing JBoss Enterprise Application Platform installation (including all applications and configuration files).

All users of JBoss Enterprise Application Platform 4.3.0 CP10 as provided from the Red Hat Customer Portal are advised to apply this update.