Red Hat Security Advisory: JBoss Enterprise Application Platform 6.0.1 update

Fixed packages 265

Vulnerabilities 9

• Medium 6.5
  CVE-2012-4549

  Jboss enterprise application platform: org.jboss.as.ejb3: jboss enterprise application platform: access restriction bypass via improper ejb method authorization

  A flaw was found in JBoss Enterprise Application Platform. The `processInvocation` function within the `org.jboss.as.ejb3.security.AuthorizationInterceptor` component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans (…

  Red Hat Red Hat JBoss Enterprise Application Platform 6.0 Red Hat JBoss Enterprise Application Platform 6 for RHEL 5
  Jan 5, 2013
• Medium 5.3
  CVE-2012-4550

  Jboss enterprise application platform: jboss eap: jbeap: jboss enterprise application platform: unauthorized ejb access via authorization module bypass

  A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans (EJB) access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Cont…

  Red Hat Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Red Hat JBoss Enterprise Application Platform 6.0
  Jan 5, 2013
• Unscored —
  CVE-2008-0455 Public exploit EPSS 65%

  Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in t…

  apache2 Debian
  Jan 25, 2008
• Medium —
  CVE-2012-2378

  Improper Authentication in Apache CXF

  Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) Sig…

  org.apache.cxf:cxf Maven
  Jan 5, 2013
• High —
  CVE-2012-2379

  XML Signature/Encryption Not Validated in Apache CXF

  Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and att…

  org.apache.cxf:cxf Maven
  Jan 3, 2013
• Unscored —
  CVE-2012-2672

  Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users t…

  mojarra Debian
  Jun 17, 2012
• Unscored —
  CVE-2012-2687 EPSS 23%

  Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_n…

  apache2 Debian
  Aug 22, 2012
• Medium —
  CVE-2012-3428

  User confusion in IronJacamar

  The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to ob…

  org.jboss.ironjacamar:ironjacamar-jdbc Maven
  Dec 20, 2012
• High —
  CVE-2012-3451

  Remote web-service operation execution in Apache CXF

  Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.

  org.apache.cxf:cxf Maven
  Sep 24, 2012

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/knowledge/docs/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=826533
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=826534
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=829560
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=843358
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=850794
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=851896
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=870868
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=870871
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1592.json
• report
  https://access.redhat.com/security/cve/CVE-2008-0455
• advisory
  https://www.cve.org/CVERecord?id=CVE-2008-0455
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2008-0455
• report
  https://access.redhat.com/security/cve/CVE-2012-2378
• advisory
  https://www.cve.org/CVERecord?id=CVE-2012-2378
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2012-2378
• article
  http://cxf.apache.org/cve-2012-2378.html
• report
  https://access.redhat.com/security/cve/CVE-2012-2379
• advisory
  https://www.cve.org/CVERecord?id=CVE-2012-2379
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2012-2379
• article
  http://cxf.apache.org/cve-2012-2379.html
• report
  https://access.redhat.com/security/cve/CVE-2012-2672
• advisory
  https://www.cve.org/CVERecord?id=CVE-2012-2672
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2012-2672
• report
  https://access.redhat.com/security/cve/CVE-2012-2687
• advisory
  https://www.cve.org/CVERecord?id=CVE-2012-2687
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2012-2687
• report
  https://access.redhat.com/security/cve/CVE-2012-3428
• advisory
  https://www.cve.org/CVERecord?id=CVE-2012-3428
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2012-3428
• report
  https://access.redhat.com/security/cve/CVE-2012-3451
• advisory
  https://www.cve.org/CVERecord?id=CVE-2012-3451
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2012-3451
• report
  https://access.redhat.com/security/cve/CVE-2012-4549
• advisory
  https://www.cve.org/CVERecord?id=CVE-2012-4549
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2012-4549
• article
  http://rhn.redhat.com/errata/RHSA-2012-1591.html
• article
  http://rhn.redhat.com/errata/RHSA-2012-1592.html