CVE: CVE-2011-1483
Component: JBossWS remote Denial of Service
Severity: Important
Release date: 2011-09-15T00:00:00+00:00

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
The References section of this erratum contains download links (you must
log in to download the update). Before applying the update, backup your
existing JBoss Communications Platform installation (including its
databases, applications, configuration files, and so on).

The JBoss Application Server process must be restarted for the update to
take effect.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, backup your
existing JBoss Enterprise BRMS Platform installation (including its
databases, applications, configuration files, and so on).

Note that it is recommended to halt the JBoss Enterprise BRMS Platform
server by stopping the JBoss Application Server process before installing
this update, and then after installing the update, restart the JBoss
Enterprise BRMS Platform server by starting the JBoss Application Server
process.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, backup your
existing JBoss Enterprise Application Platform installation (including
all applications and configuration files).

The JBoss server process must be restarted for this update to take effect.
The References section of this erratum contains a download link (you must
log in to download the updated files). Before applying the update, back up
all applications deployed on JBoss Enterprise Portal Platform, along with
all customized configuration files.

The JBoss server process must be restarted for this update to take effect.
The References section of this erratum contains a download link (you must
log in to download the updated file). Before applying the update, backup
your existing JBoss Enterprise Application Platform installation (including
all applications and configuration files).

The JBoss server process must be restarted for this update to take effect.
The References section of this erratum contains a download link (you must
log in to download the updated file). Before applying the update, back up
all applications deployed on JBoss Enterprise Portal Platform, along with
all customized configuration files.

The JBoss server process must be restarted for this update to take effect.
The References section of this erratum contains download links (you must
log in to download the updated files). Before applying the update, back up
your existing JBoss Enterprise SOA Platform installation (including its
databases, applications, configuration files, and so on).

The updates for JBoss Enterprise SOA Platform 4.2.CP05 and 4.3.CP05 contain
updated jbossws-client.jar, jbossws-common.jar, and jbossws-core.jar files.
The update for JBoss Enterprise SOA Platform 5.1.0 contains updated
jbossws-common.jar and jbossws-native-core.jar files. Refer to the
"README.text" file in each download for installation instructions.

Note that it is recommended to halt the JBoss Enterprise SOA Platform
server by stopping the JBoss Application Server process before installing
this update, and then after installing the update, restart the JBoss
Enterprise SOA Platform server by starting the JBoss Application Server
process.
The References section of this erratum contains a download link (you must
log in to download the updated file). Before applying the update, backup
your existing JBoss Enterprise Web Platform installation (including
all applications and configuration files).

The JBoss server process must be restarted for this update to take effect.