(RHSA-2013:1784) Low: Red Hat JBoss Enterprise Application Platform 6.2.0 update

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java
applications based on JBoss Application Server 7.

The HawtJNI Library class wrote native libraries to a predictable file name
in /tmp/ when the native libraries were bundled in a JAR file, and no
custom library path was specified. A local attacker could overwrite these
native libraries with malicious versions during the window between when
HawtJNI writes them and when they are executed. (CVE-2013-2035)

A flaw was found in the way method-level authorization for JAX-WS Service
endpoints was performed by the EJB invocation handler implementation.
Any restrictions declared on EJB methods were ignored when executing the
JAX-WS handlers, and only class-level restrictions were applied. A remote
attacker who is authorized to access the EJB class, could invoke a JAX-WS
handler which they were not authorized to invoke. (CVE-2013-2133)

The CVE-2013-2035 issue was discovered by Florian Weimer of the Red Hat
Product Security Team, and the CVE-2013-2133 issue was discovered by
Richard Opalka and Arun Neelicattu of Red Hat.

This release serves as a replacement for JBoss Enterprise Application
Platform 6.1.1, and includes bug fixes and enhancements. Documentation for
these changes will be available shortly from the JBoss Enterprise
Application Platform 6.2.0 Release Notes, linked to in the References.

All users of Red Hat JBoss Enterprise Application Platform 6.2.0 as
provided from the Red Hat Customer Portal are advised to apply this update.
The JBoss server process must be restarted for the update to take effect.