Prone to Bleichenbacher attack against to be distributed symmetric key
CVE: CVE-2011-2487
Component: jbossws
CWE: CWE-327
Severity: Important
Release date: 2011-01-01T00:00:00+00:00

A flaw was found in JBoss web services where the services used a weak symmetric encryption protocol, PKCS#1 v1.5. An attacker could use this weakness in chosen-ciphertext attacks to recover the symmetric key and conduct further attacks.

Statement: This flaw affects Apache CXF (WSS4J) and jbossws-native as shipped with various JBoss products. It does not affect JBoss Enterprise Application Platform 6 and JBoss Application Server 7.1.1 and above. These products include WSS4J 1.6.5, which incorporates a fix for this flaw. On affected products, this flaw can be mitigated by using the RSA-OAEP key wrap algorithm, instead of the default RSA-v1.5 algorithm. To use RSA-OAEP, edit the jboss-ws-security configuration file and add the property keyWrapAlgorithm="rsa_oaep" to the encrypt element.

Remediation:
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of JBoss Enterprise Application Platform 5.1.2 on Red Hat
Enterprise Linux 4 are advised to upgrade to these updated packages. The
JBoss server process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of JBoss Enterprise Application Platform 5.1.2 on Red Hat
Enterprise Linux 5 are advised to upgrade to these updated packages. The
JBoss server process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Web Platform installation (including all applications and
configuration files).

All users of JBoss Enterprise Web Platform 5.1.2 on Red Hat Enterprise
Linux 5 are advised to upgrade to these updated packages. The JBoss server
process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of JBoss Enterprise Application Platform 5.1.2 on Red Hat
Enterprise Linux 6 are advised to upgrade to these updated packages. The
JBoss server process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Web Platform installation (including all applications and
configuration files).

All users of JBoss Enterprise Web Platform 5.1.2 on Red Hat Enterprise
Linux 6 are advised to upgrade to these updated packages. The JBoss server
process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

Warning: Before applying the update, back up your existing JBoss Enterprise
BRMS Platform installation (including its databases, applications,
configuration files, and so on).

The References section of this erratum contains a download link (you must
log in to download the update). Warning: Before applying the update, back
up your existing JBoss Enterprise BRMS Platform installation (including its
databases, applications, configuration files, and so on).

All users of JBoss Enterprise BRMS Platform 5.3.0 as provided from the Red
Hat Customer Portal are advised to upgrade to JBoss Enterprise BRMS
Platform 5.3.1.
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

The References section of this erratum contains a download link (you must
log in to download the update). Warning: Before applying this update, back
up your existing JBoss Enterprise Application Platform installation
(including all applications and configuration files).

All users of JBoss Enterprise Application 5.1.2 as provided from the Red
Hat Customer Portal are advised to upgrade to JBoss Enterprise Application
5.2.0.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up all
applications deployed on Red Hat JBoss Portal, along with all customized
configuration files, and any databases and database settings.

Note that it is recommended to halt the Red Hat JBoss Portal server by
stopping the JBoss Application Server process before installing this
update, and then after installing the update, restart the Red Hat JBoss
Portal server by starting the JBoss Application Server process.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing JBoss Enterprise SOA Platform installation (including its
databases, applications, configuration files, and so on).
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

The References section of this erratum contains a download link (you must
log in to download the update). Warning: Before applying this update, back
up your existing JBoss Enterprise Web Platform installation (including all
applications and configuration files).

All users of JBoss Enterprise Web Platform 5.1.2 as provided from the Red
Hat Customer Portal are advised to upgrade to JBoss Enterprise Web Platform
5.2.0.