SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   Red Hat JBoss Vendors:   Red Hat
Red Hat JBoss XXE Bug Lets Remote Users Obtain Files on the Target System
SecurityTracker Alert ID:  1030607
SecurityTracker URL:  http://securitytracker.com/id/1030607
CVE Reference:   CVE-2014-3530   (Links to External Site)
Updated:  Feb 18 2015
Original Entry Date:  Jul 17 2014
Impact:   Disclosure of system information, Disclosure of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A vulnerability was reported in Red Hat JBoss. A remote user can obtain files on the target system.

A remote user can supply specially crafted XML External Entity (XXE) data to read files on the target system with the privileges of the target JBoss server.

The vulnerability resides in the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method.

Alexander Papadakis reported this vulnerability.

Impact:   A remote user can obtain files on the target system.
Solution:   The vendor has issued a fix.

The vendor's advisories are available at:

https://rhn.redhat.com/errata/RHSA-2014-0897.html
https://rhn.redhat.com/errata/RHSA-2014-0898.html
https://rhn.redhat.com/errata/RHSA-2014-0910.html
https://rhn.redhat.com/errata/RHSA-2015-0234.html
https://rhn.redhat.com/errata/RHSA-2015-0235.html

Vendor URL:  rhn.redhat.com/errata/RHSA-2014-0897.html (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Red Hat Enterprise)
Underlying OS Comments:  4, 5, 6

Message History:   None.


 Source Message Contents

Subject:  [RHSA-2014:0897-01] Important: Red Hat JBoss Enterprise Web Platform 5.2.0 security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat JBoss Enterprise Web Platform 5.2.0 security update
Advisory ID:       RHSA-2014:0897-01
Product:           Red Hat JBoss Web Platform
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2014-0897.html
Issue date:        2014-07-16
CVE Names:         CVE-2014-3530 
=====================================================================

1. Summary:

An update for Red Hat JBoss Enterprise Web Platform 5.2.0 that fixes one
security issue is now available from the Red Hat Customer Portal.

The Red Hat Security Response Team has rated this update as having
Important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

2. Description:

Red Hat JBoss Enterprise Web Platform is a platform for Java applications,
which integrates the JBoss Web Server with JBoss Hibernate and JBoss Seam.

It was found that the implementation of the
org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory() method
provided a DocumentBuilderFactory that would expand entity references.
A remote, unauthenticated attacker could use this flaw to read files
accessible to the user running the application server, and potentially
perform other more advanced XXE attacks. (CVE-2014-3530)

Red Hat would like to thank Alexander Papadakis for reporting this issue.

All users of Red Hat JBoss Enterprise Web Platform 5.2.0 as provided from
the Red Hat Customer Portal are advised to apply this update. The JBoss
server process must be restarted for this update to take effect.

3. Solution:

The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing JBoss Enterprise Web Platform installation (including all
applications and configuration files).

4. Bugs fixed (https://bugzilla.redhat.com/):

1112987 - CVE-2014-3530 PicketLink: XXE via insecure DocumentBuilderFactory usage

5. References:

https://www.redhat.com/security/data/cve/CVE-2014-3530.html
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=enterpriseweb.platform&downloadType=securityPatches&version=5.2.0

6. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2014 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFTxsQmXlSAg2UNWIIRAoLIAKCIwgSYskzuM0E7PZp+c+jBTz3StwCgp6oY
N/VqoMnFXk/GcWq+MW8+KL4=
=q2I4
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC