Description
The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 through 4.3.0.CP09, and 5.1.0; and JBoss Enterprise Web Platform (aka JBEWP) 5.1.0; allows remote attackers to cause a denial of service (daemon outage) by establishing a bisocket control connection TCP session, and then not sending any application data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Platform 5 | jboss-remoting | 2.5.3-5.SP1.1.ep5.el5 | RHSA-2010:0961 |
| Red Hat JBoss Web Platform 5 | jbossws-cxf | 3.1.2-4.SP7.6.jdk6.ep5.el5 | RHSA-2010:0961 |
| Red Hat JBoss Web Platform 5 | jopr-embedded | 1.3.4-16.SP1.7.ep5.el5 | RHSA-2010:0961 |
| Red Hat JBoss EAP 5 | jboss-remoting | 2.5.3-5.SP1.1.ep5.el4 | RHSA-2010:0960, RHSA-2010:0959 |
| Red Hat JBoss EAP 5 | jbossas-security-policy-cc | 5.1.0-1.ep5.el4 | RHSA-2010:0960, RHSA-2010:0959 |
| Red Hat JBoss EAP 5 | jbossws-cxf | 3.1.2-4.SP7.6.jdk6.ep5.el4 | RHSA-2010:0960, RHSA-2010:0959 |
| Red Hat JBoss EAP 5 | jopr-embedded | 1.3.4-16.SP1.7.ep5.el4 | RHSA-2010:0960, RHSA-2010:0959 |
| Red Hat JBoss EAP 4 | glassfish-jaxb | 2.1.4-1.17.patch04.ep1.el4 | RHSA-2010:0938, RHSA-2010:0937 |
| Red Hat JBoss EAP 4 | glassfish-jaxws | 2.1.1-1jpp.ep1.13.el4 | RHSA-2010:0938, RHSA-2010:0937 |
| Red Hat JBoss EAP 4 | hibernate3 +1 | 1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el4 | RHSA-2010:0938, RHSA-2010:0937 |
| Red Hat JBoss EAP 4 | hibernate3-annotations +1 | 3.3.1-2.0.GA_CP04.ep1.el4 | RHSA-2010:0938, RHSA-2010:0937 |
| Red Hat JBoss EAP 4 | javassist | 3.9.0-2.ep1.1.el4 | RHSA-2010:0938, RHSA-2010:0937 |
| Red Hat JBoss EAP 4 | jboss-common | 1.2.2-1.ep1.1.el4 | RHSA-2010:0938, RHSA-2010:0937 |
| Red Hat JBoss EAP 4 | jboss-messaging | 1.4.0-4.SP3_CP11.1.ep1.el4 | RHSA-2010:0938, RHSA-2010:0937 |
| Red Hat JBoss EAP 4 | jboss-remoting | 2.2.3-4.SP3.ep1.el4 | RHSA-2010:0938, RHSA-2010:0937 |
| Red Hat JBoss EAP 4 | jboss-seam +1 | 1.2.1-3.JBPAPP_4_3_0_GA.ep1.22.el4 | RHSA-2010:0938, RHSA-2010:0937 |
| Red Hat JBoss EAP 4 | jboss-seam2 +1 | 2.0.2.FP-1.ep1.26.el4 | RHSA-2010:0938, RHSA-2010:0937 |
| Red Hat JBoss EAP 4 | jbossas +2 | 4.3.0-8.GA_CP09.2.ep1.el4 | RHSA-2010:0938, RHSA-2010:0937 |
| Red Hat JBoss EAP 4 | jbossts | 1:4.2.3-2.SP5_CP10.1jpp.ep1.1.el4 | RHSA-2010:0938, RHSA-2010:0937 |
| Red Hat JBoss EAP 4 | jbossweb | 2.0.0-7.CP15.0jpp.ep1.1.el4 | RHSA-2010:0938, RHSA-2010:0937 |
| Red Hat JBoss EAP 4 | jbossws | 2.0.1-6.SP2_CP09.2.ep1.el4 | RHSA-2010:0938, RHSA-2010:0937 |
| Red Hat JBoss EAP 4 | jbossws-common | 1.0.0-3.GA_CP06.1.ep1.el4 | RHSA-2010:0938, RHSA-2010:0937 |
| Red Hat JBoss EAP 4 | jgroups | 1:2.4.9-1.ep1.el4 | RHSA-2010:0938, RHSA-2010:0937 |
| Red Hat JBoss EAP 4 | quartz | 1.5.2-1jpp.patch01.ep1.4.2.el5 | RHSA-2010:0938 |
| Red Hat JBoss EAP 4 | rh-eap-docs +1 | 4.3.0-8.GA_CP09.ep1.3.el4 | RHSA-2010:0938, RHSA-2010:0937 |
| Red Hat JBoss EAP 4 | xalan-j2 | 2.7.1-4.ep1.1.el4 | RHSA-2010:0938, RHSA-2010:0937 |
Advisories 5
- RHSA-2010:0961 Red Hat Security Advisory: JBoss Enterprise Web Platform 5.1.0 security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2010:0959 Red Hat Security Advisory: JBoss Enterprise Application Platform 5.1.0 security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2010:0960 Red Hat Security Advisory: JBoss Enterprise Application Platform 5.1.0 security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2010:0938 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP09 update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2010:0937 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP09 update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- https://issues.jboss.org/browse/JBPAPP-5253
- RHSA-2010:0938 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=641389
- RHSA-2010:0960 vendor-advisory
- RHSA-2010:0959 vendor-advisory
- https://issues.jboss.org/browse/JBREM-1261
- RHSA-2010:0937 vendor-advisory
- RHSA-2010:0961 vendor-advisory
- RHSA-2010:0962 vendor-advisory
- RHSA-2010:0939 vendor-advisory
- RHSA-2010:0963 vendor-advisory
- 1024813 vdb-entry