CVE: CVE-2012-0874
Component: JBoss invoker servlets do not require authentication
Severity: Low
Release date: 2012-01-01T00:00:00+00:00

The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors.  NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer.


Remediation:
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of JBoss Enterprise Application Platform 5.1.2 on Red Hat
Enterprise Linux 4 are advised to upgrade to these updated packages. The
JBoss server process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of JBoss Enterprise Application Platform 5.1.2 on Red Hat
Enterprise Linux 5 are advised to upgrade to these updated packages. The
JBoss server process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Web Platform installation (including all applications and
configuration files).

All users of JBoss Enterprise Web Platform 5.1.2 on Red Hat Enterprise
Linux 5 are advised to upgrade to these updated packages. The JBoss server
process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of JBoss Enterprise Application Platform 5.1.2 on Red Hat
Enterprise Linux 6 are advised to upgrade to these updated packages. The
JBoss server process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Web Platform installation (including all applications and
configuration files).

All users of JBoss Enterprise Web Platform 5.1.2 on Red Hat Enterprise
Linux 6 are advised to upgrade to these updated packages. The JBoss server
process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

Warning: Before applying the update, back up your existing JBoss Enterprise
BRMS Platform installation (including its databases, applications,
configuration files, and so on).

The References section of this erratum contains a download link (you must
log in to download the update). Warning: Before applying the update, back
up your existing JBoss Enterprise BRMS Platform installation (including its
databases, applications, configuration files, and so on).

All users of JBoss Enterprise BRMS Platform 5.3.0 as provided from the Red
Hat Customer Portal are advised to upgrade to JBoss Enterprise BRMS
Platform 5.3.1.
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

The References section of this erratum contains a download link (you must
log in to download the update). Warning: Before applying this update, back
up your existing JBoss Enterprise Application Platform installation
(including all applications and configuration files).

All users of JBoss Enterprise Application 5.1.2 as provided from the Red
Hat Customer Portal are advised to upgrade to JBoss Enterprise Application
5.2.0.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing JBoss Enterprise SOA Platform installation (including its
databases, applications, configuration files, and so on).
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

The References section of this erratum contains a download link (you must
log in to download the update). Warning: Before applying this update, back
up your existing JBoss Enterprise Web Platform installation (including all
applications and configuration files).

All users of JBoss Enterprise Web Platform 5.1.2 as provided from the Red
Hat Customer Portal are advised to upgrade to JBoss Enterprise Web Platform
5.2.0.