Arbitrary file upload via deserialization
CVE: CVE-2013-2186
Component: commons-fileupload
CWE: CWE-626
Severity: Important
Release date: 2013-10-15T00:00:00+00:00

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released 
errata relevant to your system have been applied.

See the OpenShift Enterprise 3.1 documentation, which will be 
updated shortly for release 3.1.1, for important instructions on how 
to upgrade your OpenShift cluster and fully apply this asynchronous 
errata update:

https://docs.openshift.com/enterprise/3.1/release_notes/ose_3_1_release_notes.html

This update is available via the Red Hat Network. Details on how to 
use the Red Hat Network to apply this update are available at 
https://access.redhat.com/articles/11258.
The References section of this erratum contains download links (you must
log in to download the update). Before applying this update, back up your
existing Red Hat JBoss BRMS installation (including all applications and
configuration files). For Red Hat JBoss Portal, back up all deployed
applications, along with all customized configuration files, and any
databases and database settings.

Note that it is recommended to halt the JBoss Enterprise BRMS Platform
server and the Red Hat JBoss Portal server by stopping the JBoss
Application Server process before installing this update, and then after
installing the update, restart the JBoss Enterprise BRMS Platform server by
starting the JBoss Application Server process.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss Operations Network installation (including its databases,
applications, configuration files, the JBoss Operations Network server's
file system directory, and so on).

Note: This update provides fixes for the server, agent, and core GUI
components of Red Hat JBoss Operations Network. It is recommended to apply
all the patches provided by this update.

Refer to the JBoss Operations Network 3.1.2 Release Notes for installation
information.
The References section of this erratum contains download links (you must
log in to download the update). Before applying the update, back up your
existing Red Hat JBoss SOA Platform installation (including its databases,
applications, configuration files, and so on).

Note that it is recommended to halt the Red Hat JBoss SOA Platform server
by stopping the JBoss Application Server process before installing this
update. After installing the update, restart the Red Hat JBoss SOA Platform
server by starting the JBoss Application Server process.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing Red Hat JBoss Enterprise Web Server installation (including all
applications and configuration files).

The JBoss server process must be restarted for the update to take effect.