Important: Red Hat Security Advisory: tomcat5 and tomcat6 security update

Updated tomcat5 and tomcat6 packages that fix one security issue are now available for JBoss Enterprise Web Server 1.0.2 for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS...

Important: Red Hat Security Advisory: tomcat6 and tomcat7 security update

Updated tomcat6 and tomcat7 packages that fix one security issue are now available for JBoss Enterprise Web Server 2.0.0 for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS...

RHEL 5 : JBoss EAP (RHSA-2013:0839)

Updated JBoss Enterprise Application Platform 6.1.0 packages that fix three security issues, various bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability...

RHEL 6 : JBoss Enterprise Application Platform 6.1.0 update (Important) (RHSA-2013:0834)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0834 advisory. JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 6.1.0 update

Updated JBoss Enterprise Application Platform 6.1.0 packages that fix three security issues, various bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability...

JBoss: custom authorization module implementations shared between applications

Red Hat JBoss Enterprise Application Platform EAP before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loaded and the modules share class names, which allows local users to control...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 6.1.0 update

Updated JBoss Enterprise Application Platform 6.1.0 packages that fix three security issues, various bugs, and add enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability...

JBoss: custom authorization module implementations shared between applications

Red Hat JBoss Enterprise Application Platform EAP before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loaded and the modules share class names, which allows local users to control...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 6.1.0 update

JBoss Enterprise Application Platform 6.1.0, which fixes multiple security issues, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring...

Installer: Generated auto-install xml is world readable

The GUI installer in JBoss Enterprise Application Platform EAP and Enterprise Web Platform EWP 5.2.0 and possibly 5.1.2 uses world-readable permissions for the auto-install XML file, which allows local users to obtain the administrator password and the sucker password by reading this file...

Moderate: Red Hat Security Advisory: openssl security update

An update for the OpenSSL component for JBoss Enterprise Application Platform 5.2.0 for Solaris and Microsoft Windows that fixes two security issues is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. Comm...

Moderate: Red Hat Security Advisory: openssl security update

An update for the OpenSSL component for JBoss Enterprise Web Platform 5.2.0 for Solaris and Microsoft Windows that fixes two security issues is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. Common...

JBoss 4.2.0 BSHDeployer 代码执行漏洞

JBoss是基于J2EE的开放源代码的应用服务器，其4.2.0版本默认会开启BSHDeployer服务， 当攻击者绕过JMX-console拦截里， 可以利用BSHDeployer服务方便地（将war信息直接写在bsh文件里）部署一个war，从而成功地远程部署了恶意代码。 JBoss 4.2.0...

JBoss 4.2.0 JMXInvoker 代码执行漏洞

JBoss是基于J2EE的开放源代码的应用服务器，其4.2.0默认会开启JMXInvoker， 攻击可使用JMXInvoker部署一个war，从而成功地远程部署了恶意代码。 JBoss 4.2.0...

JBoss 4.2.0 WebConsole/Invoker 代码执行漏洞

JBoss是基于J2EE的开放源代码的应用服务器，其4.2.0版本会开启WebConsole， 攻击可使用WebConsole/Invoker部署一个war，从而成功地远程部署了恶意代码。 JBoss 4.2.0...

JBoss Web Services Endpoint Enumeration

JBossWS, a framework similar to JAX-WS for making Java EE web services, is listening on the remote host and lists its registered endpoints. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid66189; scriptversion"1.3";...

Moderate: Red Hat Security Advisory: JBoss Web Framework Kit 2.2.0 update

JBoss Web Framework Kit 2.2.0, which fixes two security issues, various bugs, and adds enhancements is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

Important: Red Hat Security Advisory: apache-cxf security update

An update for the Apache CXF component of JBoss Portal Platform 6.0.0 which fixes two security issues is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base...

JBoss Enterprise Portal GateIn Portal XML解析任意文件读取漏洞

CVE ID:CVE-2013-0315 JBoss Enterprise Portal Platform是一款构建和管理动态网站的平台。 JBoss Enterprise Portal Platform GateIn Portal export/import gadget存在一个漏洞可导致XML外部实体攻击。如果提供给import gadget的XML包含外部XML实体，此实体会被解析，可访问import gadget的远程攻击者可以利用此漏洞以运行应用服务器上下文读取任意文件。 0 JBoss Enterprise Portal Platform 5.2.2 厂商解决方案...

JBoss Enterprise Portal GateIn Portal未验证站点导入漏洞

CVE ID:CVE-2013-0314 JBoss Enterprise Portal Platform是一款构建和管理动态网站的平台。 JBoss Enterprise Portal Platform GateIn Portal export/import gadget在导入Zip文件时没有正确检查验证，允许远程攻击者利用漏洞修改站点内容，删除站点，或修改应用在站点portlet中的访问控制。 0 JBoss Enterprise Portal Platform 5.2.2 厂商解决方案 用户可参考如下厂商提供的安全公告获得补丁信息：...