rhsa-2011_1148
Vulnerability from csaf_redhat
Published
2011-08-10 18:23
Modified
2024-11-22 04:56
Summary
Red Hat Security Advisory: JBoss Communications Platform 5.1.1 update
Notes
Topic
JBoss Communications Platform 5.1.1, which fixes one security issue and
various bugs, is now available from the Red Hat Customer Portal.
The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.
Details
The JBoss Communications Platform (JBCP) is an open source VoIP platform
certified for JAIN SLEE 1.1 and SIP Servlets 1.1 compliance. JBCP serves as
a high performance core for Service Delivery Platforms (SDPs) and IP
Multimedia Subsystems (IMSs) by leveraging J2EE to enable the convergence
of data and video in Next-Generation Intelligent Network (NGIN)
applications.
This release of JBoss Communications Platform 5.1.1 serves as a replacement
to JBoss Communications Platform 5.1.0. It includes various bug fixes which
are detailed in the Release Notes. The Release Notes will be available
shortly from the link in the References section.
The following security issue is also fixed with this release:
It was found that JBoss Seam 2 did not properly block access to JBoss
Expression Language (EL) constructs in page exception handling, allowing
arbitrary Java methods to be executed. A remote attacker could use this
flaw to execute arbitrary code via a specially-crafted URL provided to
certain applications based on the JBoss Seam 2 framework. Note: A properly
configured and enabled Java Security Manager would prevent exploitation of
this flaw. (CVE-2011-1484)
If you have created custom applications that are packaged with a copy of
the JBoss Seam 2 library, those applications must be rebuilt with the
updated jboss-seam.jar file provided by this update.
Red Hat would like to thank Martin Kouba from IT SYSTEMS a.s. for reporting
this issue.
Warning: Before applying this update, back up all applications deployed on
JBoss Communications Platform, along with all customized configuration
files.
All users of JBoss Communications Platform 5.1.0 as provided from the Red
Hat Customer Portal are advised to upgrade to JBoss Communications
Platform 5.1.1.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "JBoss Communications Platform 5.1.1, which fixes one security issue and\nvarious bugs, is now available from the Red Hat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from the\nCVE link in the References section.", "title": "Topic" }, { "category": "general", "text": "The JBoss Communications Platform (JBCP) is an open source VoIP platform\ncertified for JAIN SLEE 1.1 and SIP Servlets 1.1 compliance. JBCP serves as\na high performance core for Service Delivery Platforms (SDPs) and IP\nMultimedia Subsystems (IMSs) by leveraging J2EE to enable the convergence\nof data and video in Next-Generation Intelligent Network (NGIN)\napplications.\n\nThis release of JBoss Communications Platform 5.1.1 serves as a replacement\nto JBoss Communications Platform 5.1.0. It includes various bug fixes which\nare detailed in the Release Notes. The Release Notes will be available\nshortly from the link in the References section.\n\nThe following security issue is also fixed with this release:\n\nIt was found that JBoss Seam 2 did not properly block access to JBoss\nExpression Language (EL) constructs in page exception handling, allowing\narbitrary Java methods to be executed. A remote attacker could use this\nflaw to execute arbitrary code via a specially-crafted URL provided to\ncertain applications based on the JBoss Seam 2 framework. Note: A properly\nconfigured and enabled Java Security Manager would prevent exploitation of\nthis flaw. (CVE-2011-1484)\n\nIf you have created custom applications that are packaged with a copy of\nthe JBoss Seam 2 library, those applications must be rebuilt with the\nupdated jboss-seam.jar file provided by this update.\n\nRed Hat would like to thank Martin Kouba from IT SYSTEMS a.s. for reporting\nthis issue.\n\nWarning: Before applying this update, back up all applications deployed on\nJBoss Communications Platform, along with all customized configuration\nfiles.\n\nAll users of JBoss Communications Platform 5.1.0 as provided from the Red\nHat Customer Portal are advised to upgrade to JBoss Communications\nPlatform 5.1.1.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2011:1148", "url": "https://access.redhat.com/errata/RHSA-2011:1148" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://docs.redhat.com/docs/en-US/JBoss_Communications_Platform/5.1/html/5.1.1_Release_Notes/index.html", "url": "https://docs.redhat.com/docs/en-US/JBoss_Communications_Platform/5.1/html/5.1.1_Release_Notes/index.html" }, { "category": "external", "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=communications.platform\u0026downloadType=distributions", "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=communications.platform\u0026downloadType=distributions" }, { "category": "external", "summary": "692421", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=692421" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1148.json" } ], "title": "Red Hat Security Advisory: JBoss Communications Platform 5.1.1 update", "tracking": { "current_release_date": "2024-11-22T04:56:49+00:00", "generator": { "date": "2024-11-22T04:56:49+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2011:1148", "initial_release_date": "2011-08-10T18:23:00+00:00", "revision_history": [ { "date": "2011-08-10T18:23:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2011-08-10T14:33:34+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T04:56:49+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "JBoss Communications Platform 5.1", "product": { "name": "JBoss Communications Platform 5.1", "product_id": "JBoss Communications Platform 5.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_communications_platform:5.1" } } } ], "category": "product_family", "name": "Red Hat JBoss Middleware" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Martin Kouba" ], "organization": "IT SYSTEMS a.s." } ], "cve": "CVE-2011-1484", "discovery_date": "2011-03-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "692421" } ], "notes": [ { "category": "description", "text": "jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP04 and 5.1.0 and JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3.0.CP09 and 5.1.0, does not properly restrict use of Expression Language (EL) statements in FacesMessages during page exception handling, which allows remote attackers to execute arbitrary Java code via a crafted URL to an application.", "title": "Vulnerability description" }, { "category": "summary", "text": "JBoss Seam privilege escalation caused by EL interpolation in FacesMessages", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "JBoss Communications Platform 5.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2011-1484" }, { "category": "external", "summary": "RHBZ#692421", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=692421" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2011-1484", "url": "https://www.cve.org/CVERecord?id=CVE-2011-1484" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2011-1484", "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1484" } ], "release_date": "2011-04-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2011-08-10T18:23:00+00:00", "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).", "product_ids": [ "JBoss Communications Platform 5.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2011:1148" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "JBoss Communications Platform 5.1" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "JBoss Seam privilege escalation caused by EL interpolation in FacesMessages" } ] }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.