CVE: CVE-2011-2196
Component: JBoss Seam EL interpolation in exception handling
Severity: Important
Release date: 2011-07-18T00:00:00+00:00

jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP05 and 5.1.0; JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3.0, 4.3.0.CP09, and 5.1.1; and JBoss Enterprise Web Platform 5.1.1, does not properly restrict use of Expression Language (EL) statements in FacesMessages during page exception handling, which allows remote attackers to execute arbitrary Java code via a crafted URL to an application.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1484.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

For this update to take effect:

1) If you have created custom applications that are packaged with a
copy of the JBoss Seam 2 library, those applications must be rebuilt
with the updated jboss-seam.jar file provided by this update.

2) Restart the JBoss server process.
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

For this update to take effect:

1) If you have created custom applications that are packaged with a
copy of the JBoss Seam 2 library, those applications must be rebuilt
with the updated jboss-seam.jar file provided by this update.

2) Restart the JBoss server process.
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

For this update to take effect:

1) If you have created custom applications that are packaged with a
copy of the JBoss Seam 2 library, those applications must be rebuilt
with the updated jboss-seam.jar file provided by this update.

2) Restart the JBoss server process.
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

For this update to take effect:

1) If you have created custom applications that are packaged with a
copy of the JBoss Seam 2 library, those applications must be rebuilt
with the updated jboss-seam.jar file provided by this update.

2) Restart the JBoss server process.
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

For this update to take effect:

1) If you have created custom applications that are packaged with a
copy of the JBoss Seam 2 library, those applications must be rebuilt
with the updated jboss-seam.jar file provided by this update.

2) Restart the JBoss server process.
The References section of this erratum contains a download link (you must
log in to download the updated file). Before applying the update, backup
your existing JBoss Enterprise Application Platform installation (including
all applications and configuration files).

Important: JBoss Enterprise Application Platform 4.3.0.CP09 ships with both
the JBoss Seam and JBoss Seam 2 frameworks. Ensure you only replace version
2 with the updated jboss-seam.jar file.

If you have created custom applications that are packaged with a copy of
the JBoss Seam 2 library, those applications must be rebuilt with the
updated jboss-seam.jar file.

The JBoss server process must be restarted for the update to take effect.
The References section of this erratum contains a download link (you must
log in to download the update).
The References section of this erratum contains download links (you must
log in to download the updated file). Before applying the update, backup
your existing JBoss Enterprise SOA Platform installation (including its
databases, applications, configuration files, and so on).

Important: JBoss Enterprise SOA Platform 4.3.0.CP05 ships with both the
JBoss Seam and JBoss Seam 2 frameworks. Ensure you only replace version
2 with the updated jboss-seam.jar file.

If you have created custom applications that are packaged with a copy of
the JBoss Seam 2 library, those applications must be rebuilt with the
updated jboss-seam.jar file.

The JBoss Application Server process must be restarted for the update to
take effect.