(RHSA-2016:1435) Critical: Red Hat JBoss Enterprise Application Platform 6.4.9 update

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7.

This release of Red Hat JBoss Enterprise Application Platform 6.4.9 serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.8, and includes bug fixes and enhancements. Documentation for these changes will be available shortly from the Red Hat JBoss Enterprise Application Platform 6.4.9 Release Notes, linked to in the References.

Security Fix(es):

• It was found that JGroups did not require necessary headers for encrypt
  and auth protocols from new nodes joining the cluster. An attacker could
  use this flaw to bypass security restrictions, and use this vulnerability
  to send and receive messages within the cluster, leading to information
  disclosure, message spoofing, or further possible attacks. (CVE-2016-2141)

More information about this vulnerability is available at: https://access.redhat.com/articles/2360521

• A directory traversal flaw was found in Tomcat’s and JBoss Web’s
  RequestUtil.java. A remote, authenticated user could use this flaw to
  bypass intended SecurityManager restrictions and list a parent directory
  via a ‘/…’ in a pathname used by a web application in a getResource,
  getResourceAsStream, or getResourcePaths call, as demonstrated by the
  $CATALINA_BASE/webapps directory. (CVE-2015-5174)

The CVE-2016-2141 issue was discovered by Dennis Reed (Red Hat).