jsessionid exposed via encoded url when using cookie based session tracking
CVE: CVE-2012-4529
Component: Web
Severity: Low
Release date: 2012-10-10T00:00:00+00:00

The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id (1) via a man-in-the-middle attack or (2) by reading a log.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied. Also, back up any customized
JBoss Enterprise Application Platform 6 configuration files. On update, the
configuration files that have been locally modified will not be updated.
The updated version of such files will be stored as the rpmnew files. Make
sure to locate any such files after the update and merge any changes
manually.

For more details, refer to the Release Notes for JBoss Enterprise
Application Platform 6.1.0, available shortly from
https://access.redhat.com/site/documentation/

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied. Also, back up any customized
JBoss Enterprise Application Platform 6 configuration files. On update, the
configuration files that have been locally modified will not be updated.
The updated version of such files will be stored as the rpmnew files. Make
sure to locate any such files after the update and merge any changes
manually.

For more details, refer to the Release Notes for JBoss Enterprise
Application Platform 6.1.0, available shortly from
https://access.redhat.com/site/documentation/

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss Enterprise Application Platform installation and deployed
applications.
Red Hat would like to thank Tibor Jager, Kenneth G. Paterson and Juraj
Somorovsky of Ruhr-University Bochum for reporting CVE-2012-5575; and
Andreas Falkenberg of SEC Consult Deutschland GmbH, and Christian Mainka,
Juraj Somorovsky, and Joerg Schwenk of Ruhr-University Bochum for reporting
CVE-2013-2160. CVE-2012-4572 was discovered by Josef Cacek of the Red Hat
JBoss EAP Quality Engineering team; CVE-2013-4128 and CVE-2013-4213 were
discovered by Wolf-Dieter Fink of the Red Hat GSS Team; and CVE-2013-2102
was discovered by Red Hat.

All users of Red Hat JBoss Portal 6.0.0 as provided from the Red Hat
Customer Portal are advised to upgrade to Red Hat JBoss Portal 6.1.0.

The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up all
applications deployed on JBoss Enterprise Portal Platform, along with all
customized configuration files, and any databases and database settings.