CVE: CVE-2011-2908
Component: CSRF on jmx-console allows invocation of operations on mbeans
CWE: CWE-352
Severity: Moderate
Release date: 2011-01-01T00:00:00+00:00

Cross-site request forgery (CSRF) vulnerability in the JMX Console (jmx-console) in JBoss Enterprise Portal Platform before 5.2.2, BRMS Platform 5.3.0 before roll up patch1, and SOA Platform 5.3.0 allows remote authenticated users to hijack the authentication of arbitrary users for requests that perform operations on MBeans and possibly execute arbitrary code via unspecified vectors.


Remediation:
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of JBoss Enterprise Application Platform 5.1.2 on Red Hat
Enterprise Linux 4 are advised to upgrade to these updated packages. The
JBoss server process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of JBoss Enterprise Application Platform 5.1.2 on Red Hat
Enterprise Linux 5 are advised to upgrade to these updated packages. The
JBoss server process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Web Platform installation (including all applications and
configuration files).

All users of JBoss Enterprise Web Platform 5.1.2 on Red Hat Enterprise
Linux 5 are advised to upgrade to these updated packages. The JBoss server
process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation (including all applications
and configuration files).

All users of JBoss Enterprise Application Platform 5.1.2 on Red Hat
Enterprise Linux 6 are advised to upgrade to these updated packages. The
JBoss server process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

Warning: Before applying this update, back up your existing JBoss
Enterprise Web Platform installation (including all applications and
configuration files).

All users of JBoss Enterprise Web Platform 5.1.2 on Red Hat Enterprise
Linux 6 are advised to upgrade to these updated packages. The JBoss server
process must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing JBoss Enterprise BRMS Platform installation (including its
databases, applications, configuration files, and so on).

Note that it is recommended to halt the JBoss Enterprise BRMS Platform
server by stopping the JBoss Application Server process before installing
this update, and then after installing the update, restart the JBoss
Enterprise BRMS Platform server by starting the JBoss Application Server
process.
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

The References section of this erratum contains a download link (you must
log in to download the update). Warning: Before applying this update, back
up your existing JBoss Enterprise Application Platform installation
(including all applications and configuration files).

All users of JBoss Enterprise Application 5.1.2 as provided from the Red
Hat Customer Portal are advised to upgrade to JBoss Enterprise Application
5.2.0.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up all
applications deployed on JBoss Enterprise Portal Platform, along with all
customized configuration files, and any databases and database settings.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing JBoss Enterprise SOA Platform installation (including its
databases, applications, configuration files, and so on).

Note that it is recommended to halt the JBoss Enterprise SOA Platform
server by stopping the JBoss Application Server process before installing
this update, and then after installing the update, restart the JBoss
Enterprise SOA Platform server by starting the JBoss Application Server
process.
Note: Manual action is required to apply the fix for CVE-2011-2730. If your
system has deployed applications which use Spring framework, the context
parameter "springJspExpressionSupport" must be set to "false" to mitigate
this flaw, for example, in the application's web.xml file. This will
prevent the double-evaluation of EL expressions that led to this flaw.

CVE-2012-2379 has been addressed by disabling the affected configuration in
this release. If you use the affected configuration, an exception will be
thrown and the relevant application will not deploy to the server. A patch
that allows the affected configuration to be used without this
vulnerability is available in JBoss Enterprise Application Platform 6.0.1.

The References section of this erratum contains a download link (you must
log in to download the update). Warning: Before applying this update, back
up your existing JBoss Enterprise Web Platform installation (including all
applications and configuration files).

All users of JBoss Enterprise Web Platform 5.1.2 as provided from the Red
Hat Customer Portal are advised to upgrade to JBoss Enterprise Web Platform
5.2.0.