CVE: CVE-2010-3862
Component: JBoss Remoting Denial-Of-Service
Severity: Low
Release date: 2010-12-01T00:00:00+00:00

The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 through 4.3.0.CP09, and 5.1.0; and JBoss Enterprise Web Platform (aka JBEWP) 5.1.0; allows remote attackers to cause a denial of service (daemon outage) by establishing a bisocket control connection TCP session, and then not sending any application data.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259
JBoss Enterprise Application Platform 4.3.0.CP09 is available from the Red
Hat Customer Portal. To download and install the complete JBEAP 4.3.0.CP09
distribution:

1) Log into the Customer Portal: https://access.redhat.com/login

2) Navigate to
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

3) On the left-hand side menu, under "JBoss Enterprise Platforms" click
"Application Platform". Then, use the "Version:" drop down menu to select
"4.3.0.GA_CP09".

4) Select the desired installation method, for example the binary
installer.
A patch to correct CVE-2010-3862 for JBoss Enterprise Application Platform
5.1 is available from the Red Hat Customer Portal. To download this patch:

1) Backup your existing JBoss Enterprise Application Platform installation
(including all applications and configuration files).

2) Log into the Customer Portal: https://access.redhat.com/login

3) Navigate to
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

4) On the left-hand side menu, under "JBoss Enterprise Platforms" click
"Application Platform". Then, use the "Version:" drop down menu to select
"5.1.0".

5) The patch is available from the "Security Advisories" link. After
applying the patch, the JBoss server process must be restarted for the
update to take effect.
A patch to correct CVE-2010-3862 for JBoss Enterprise Web Platform 5.1 is
available from the Red Hat Customer Portal. To download this patch:

1) Backup your existing JBoss Enterprise Web Platform installation
(including all applications and configuration files).

2) Log into the Customer Portal: https://access.redhat.com/login

3) Navigate to
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

4) On the left-hand side menu, under "JBoss Enterprise Platforms" click
"Enterprise Web Platform". Then, use the "Version:" drop down menu to
select "5.1.0".

5) The patch is available from the "Security Advisories" link. After
applying the patch, the JBoss server process must be restarted for the
update to take effect.