malicious worker nodes can register on any vhost
CVE: CVE-2011-4608
Component: mod_cluster
CWE: CWE-863
Severity: Important
Release date: 2011-01-01T00:00:00+00:00

mod_cluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from an external vhost that does not enforce security constraints.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

To apply this update:

1) Install the updated mod_cluster-native package on the JBoss
Enterprise Application Platform worker node.

2) Copy the Apache HTTP Server modules provided by the updated package
to your JBoss Enterprise Web Server front-end.

3) Restart the Apache HTTP Server on your JBoss Enterprise Web Server
front-end.

Refer to the "Install proxy server components" section of the HTTP
Connectors Load Balancing Guide for JBoss Enterprise Application
Platform 5, available from docs.redhat.com, for further information.
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

To apply this update:

1) Install the updated mod_cluster-native package on the JBoss
Enterprise Web Platform worker node.

2) Copy the Apache HTTP Server modules provided by the updated package
to your JBoss Enterprise Web Server front-end.

3) Restart the Apache HTTP Server on your JBoss Enterprise Web Server
front-end.

Refer to the "Install proxy server components" section of the HTTP
Connectors Load Balancing Guide for JBoss Enterprise Application
Platform 5, available from docs.redhat.com, for further information
(JBoss Enterprise Web Platform is a subset of JBoss Enterprise
Application Platform).
The References section of this erratum contains a download link (you
must log in to download the update). To apply the update:

1) Download the update for the Native components for JBoss Enterprise
Application Platform 5.1.2.

2) Copy the Apache HTTP Server modules provided by the update to your
JBoss Enterprise Web Server front-end.

3) Restart the Apache HTTP Server on your JBoss Enterprise Web Server
front-end.

Refer to the "Install proxy server components" section of the HTTP
Connectors Load Balancing Guide for JBoss Enterprise Application
Platform 5, available from docs.redhat.com, for further information.
The References section of this erratum contains a download link (you
must log in to download the update). To apply the update:

1) Download the update for the Native components for JBoss Enterprise
Web Platform 5.1.2.

2) Copy the Apache HTTP Server modules provided by the update to your
JBoss Enterprise Web Server front-end.

3) Restart the Apache HTTP Server on your JBoss Enterprise Web Server
front-end.

Refer to the "Install proxy server components" section of the HTTP
Connectors Load Balancing Guide for JBoss Enterprise Application
Platform 5, available from docs.redhat.com, for further information
(JBoss Enterprise Web Platform is a subset of JBoss Enterprise
Application Platform).
The References section of this erratum contains a download link (you must
log in to download the update).

The Apache HTTP Server must be restarted for this update to take effect.