Insecure storage of masked passwords
CVE: CVE-2013-1921
Component: PicketBox
Severity: Low
Release date: 2013-09-04T00:00:00+00:00

PicketBox, as used in Red Hat JBoss Enterprise Application Platform before 6.1.1, allows local users to obtain the admin encryption key by reading the Vault data file.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied. Also, back up any customized
Red Hat JBoss Enterprise Application Platform 6 configuration files. On
update, the configuration files that have been locally modified will not be
updated. The updated version of such files will be stored as the rpmnew
files. Make sure to locate any such files after the update and merge any
changes manually.

For more details, refer to the Release Notes for Red Hat JBoss Enterprise
Application Platform 6.1.1, available shortly from
https://access.redhat.com/site/documentation/

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied. Also, back up any customized
Red Hat JBoss Enterprise Application Platform 6 configuration files. On
update, the configuration files that have been locally modified will not be
updated. The updated version of such files will be stored as the rpmnew
files. Make sure to locate any such files after the update and merge any
changes manually.

For more details, refer to the Release Notes for Red Hat JBoss Enterprise
Application Platform 6.1.1, available shortly from
https://access.redhat.com/site/documentation/

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss Data Grid installation.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing Red Hat JBoss Enterprise Application Platform installation and
deployed applications.
Red Hat would like to thank Tibor Jager, Kenneth G. Paterson and Juraj
Somorovsky of Ruhr-University Bochum for reporting CVE-2012-5575; and
Andreas Falkenberg of SEC Consult Deutschland GmbH, and Christian Mainka,
Juraj Somorovsky, and Joerg Schwenk of Ruhr-University Bochum for reporting
CVE-2013-2160. CVE-2012-4572 was discovered by Josef Cacek of the Red Hat
JBoss EAP Quality Engineering team; CVE-2013-4128 and CVE-2013-4213 were
discovered by Wolf-Dieter Fink of the Red Hat GSS Team; and CVE-2013-2102
was discovered by Red Hat.

All users of Red Hat JBoss Portal 6.0.0 as provided from the Red Hat
Customer Portal are advised to upgrade to Red Hat JBoss Portal 6.1.0.

The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up all
applications deployed on JBoss Enterprise Portal Platform, along with all
customized configuration files, and any databases and database settings.