rhsa-2012_1344
Vulnerability from csaf_redhat
Published
2012-10-08 16:38
Modified
2024-09-15 20:04
Summary
Red Hat Security Advisory: JBoss Enterprise Portal Platform 5.2.2 security update

Notes

Topic
An update for the JBoss Web Services component in JBoss Enterprise Portal Platform 5.2.2 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Details
JBoss Enterprise Portal Platform is the open source implementation of the Java EE suite of services and Portal services running atop JBoss Enterprise Application Platform. It comprises a set of offerings for enterprise customers who are looking for pre-configured profiles of JBoss Enterprise Middleware components that have been tested and certified together to provide an integrated experience. An attack technique was found against the W3C XML Encryption Standard when block ciphers were used in cipher-block chaining (CBC) mode. A remote attacker could use this flaw to conduct chosen-ciphertext attacks, leading to the recovery of the entire plain text of a particular cryptogram by examining the differences between SOAP (Simple Object Access Protocol) responses sent from JBoss Web Services. (CVE-2011-1096) Red Hat would like to thank Juraj Somorovsky of Ruhr-University Bochum for reporting this issue. Note: Manual action is required to apply this update. The CVE-2011-1096 issue is an attack on the WS-Security standard itself. Using new Galois/Counter Mode (GCM) based algorithms for WS-Security encryption is the W3C suggested way of dealing with this issue. The WS-SecurityPolicy specification has not yet been updated to include the new algorithms. Consequently, Apache CXF independently added support for such GCM based algorithms through AlgorithmSuites called "Basic128GCM", "Basic192GCM", and "Basic256GCM" in the namespace "http://cxf.apache.org/custom/security-policy". To apply these policies to your applications that use WS-Security encryption, specify them in the application's WSDL file. Refer to Red Hat Bugzilla bug 681916 for an example. All users of JBoss Enterprise Portal Platform 5.2.2 as provided from the Red Hat Customer Portal are advised to install this update.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the JBoss Web Services component in JBoss Enterprise Portal\nPlatform 5.2.2 that fixes one security issue is now available from the Red\nHat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from the\nCVE link in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "JBoss Enterprise Portal Platform is the open source implementation of the\nJava EE suite of services and Portal services running atop JBoss Enterprise\nApplication Platform. It comprises a set of offerings for enterprise\ncustomers who are looking for pre-configured profiles of JBoss Enterprise\nMiddleware components that have been tested and certified together to\nprovide an integrated experience.\n\nAn attack technique was found against the W3C XML Encryption Standard when\nblock ciphers were used in cipher-block chaining (CBC) mode. A remote\nattacker could use this flaw to conduct chosen-ciphertext attacks, leading\nto the recovery of the entire plain text of a particular cryptogram by\nexamining the differences between SOAP (Simple Object Access Protocol)\nresponses sent from JBoss Web Services. (CVE-2011-1096)\n\nRed Hat would like to thank Juraj Somorovsky of Ruhr-University Bochum\nfor reporting this issue.\n\nNote: Manual action is required to apply this update. The CVE-2011-1096\nissue is an attack on the WS-Security standard itself. Using new\nGalois/Counter Mode (GCM) based algorithms for WS-Security encryption is\nthe W3C suggested way of dealing with this issue. The WS-SecurityPolicy\nspecification has not yet been updated to include the new algorithms.\nConsequently, Apache CXF independently added support for such GCM based\nalgorithms through AlgorithmSuites called \"Basic128GCM\", \"Basic192GCM\", and\n\"Basic256GCM\" in the namespace\n\"http://cxf.apache.org/custom/security-policy\".\n\nTo apply these policies to your applications that use WS-Security\nencryption, specify them in the application\u0027s WSDL file. Refer to Red Hat\nBugzilla bug 681916 for an example.\n\nAll users of JBoss Enterprise Portal Platform 5.2.2 as provided from the\nRed Hat Customer Portal are advised to install this update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2012:1344",
        "url": "https://access.redhat.com/errata/RHSA-2012:1344"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal\u0026downloadType=securityPatches\u0026version=5.2.2",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal\u0026downloadType=securityPatches\u0026version=5.2.2"
      },
      {
        "category": "external",
        "summary": "681916",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=681916"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2012/rhsa-2012_1344.json"
      }
    ],
    "title": "Red Hat Security Advisory: JBoss Enterprise Portal Platform 5.2.2 security update",
    "tracking": {
      "current_release_date": "2024-09-15T20:04:10+00:00",
      "generator": {
        "date": "2024-09-15T20:04:10+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "3.33.3"
        }
      },
      "id": "RHSA-2012:1344",
      "initial_release_date": "2012-10-08T16:38:00+00:00",
      "revision_history": [
        {
          "date": "2012-10-08T16:38:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2012-10-08T16:42:36+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-09-15T20:04:10+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Portal 5.2",
                "product": {
                  "name": "Red Hat JBoss Portal 5.2",
                  "product_id": "Red Hat JBoss Portal 5.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_portal_platform:5.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Middleware"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2011-1096",
      "cwe": {
        "id": "CWE-327",
        "name": "Use of a Broken or Risky Cryptographic Algorithm"
      },
      "discovery_date": "2011-02-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "681916"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The W3C XML Encryption Standard, as used in the JBoss Web Services (JBossWS) component in JBoss Enterprise Portal Platform before 5.2.2 and other products, when using block ciphers in cipher-block chaining (CBC) mode, allows remote attackers to obtain plaintext data via a chosen-ciphertext attack on SOAP responses, aka \"character encoding pattern attack.\"",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jbossws: Prone to character encoding pattern attack (XML Encryption flaw)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 5.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2011-1096"
        },
        {
          "category": "external",
          "summary": "RHBZ#681916",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=681916"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2011-1096",
          "url": "https://www.cve.org/CVERecord?id=CVE-2011-1096"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2011-1096",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1096"
        }
      ],
      "release_date": "2011-10-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Enterprise Portal Platform, along with all\ncustomized configuration files, and any databases and database settings.\n\nNote that it is recommended to halt the JBoss Enterprise Portal Platform\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the JBoss\nEnterprise Portal Platform server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss Portal 5.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:1344"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 7.8,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 5.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jbossws: Prone to character encoding pattern attack (XML Encryption flaw)"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.