(RHSA-2014:1904) Important: Red Hat JBoss Operations Network 3.3.0 update


Red Hat JBoss Operations Network is a middleware management solution that provides a single point of control to deploy, manage, and monitor JBoss Enterprise Middleware, applications, and services. This JBoss Operations Network 3.3.0 release serves as a replacement for JBoss Operations Network 3.2.3, and includes several bug fixes. Refer to the JBoss Operations Network 3.3.0 Release Notes for information on the most significant of these changes. The Release Notes will be available shortly from https://access.redhat.com/documentation/en-US/ The following security issues are also fixed with this release: It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577) It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity (XXE) attacks on RESTEasy applications accepting XML input. (CVE-2014-3481) It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. (CVE-2014-3490) The HawtJNI Library class wrote native libraries to a predictable file name in /tmp when the native libraries were bundled in a JAR file, and no custom library path was specified. A local attacker could overwrite these native libraries with malicious versions during the window between when HawtJNI writes them and when they are executed. (CVE-2013-2035) It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in the audit.log file. (CVE-2014-0059) The CVE-2013-2035 and CVE-2012-6153 issues were discovered by Florian Weimer of Red Hat Product Security. The CVE-2014-3481 issue was discovered by the Red Hat JBoss Enterprise Application Platform QE team. The CVE-2014-3490 issue was discovered by David Jorm of Red Hat Product Security. All users of JBoss Operations Network 3.2.3 as provided from the Red Hat Customer Portal are advised to upgrade to JBoss Operations Network 3.3.0.