Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2015.0075
Moderate: Red Hat JBoss Data Virtualization 6.0.0 security update
13 January 2015
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Red Hat JBoss Data Virtualization 6.0.0
Publisher: Red Hat
Operating System: Red Hat
Windows
Solaris
Impact/Access: Access Privileged Data -- Existing Account
Overwrite Arbitrary Files -- Existing Account
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2014-0171 CVE-2014-0058 CVE-2013-2035
Reference: ESB-2014.2402
ESB-2014.2219
ESB-2014.1653
ESB-2014.1652
ESB-2014.0236
ESB-2014.0061
ESB-2013.1734
ESB-2013.0951
Original Bulletin:
https://rhn.redhat.com/errata/RHSA-2015-0034.html
- --------------------------BEGIN INCLUDED TEXT--------------------
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat JBoss Data Virtualization 6.0.0 security update
Advisory ID: RHSA-2015:0034-01
Product: Red Hat JBoss Data Virtualization
Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0034.html
Issue date: 2015-01-12
CVE Names: CVE-2013-2035 CVE-2014-0058 CVE-2014-0171
=====================================================================
1. Summary:
Red Hat JBoss Data Virtualization 6.0.0 roll up patch 4, which fixes three
security issues and various bugs, is now available from the Red Hat
Customer Portal.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
2. Description:
Red Hat JBoss Data Virtualization is a lean data integration solution that
provides easy, real-time, and unified data access across disparate sources
to multiple applications and users. JBoss Data Virtualization makes data
spread across physically distinct systems "such as multiple databases, XML
files, and even Hadoop systems" appear as a set of tables in a local
database.
This roll up patch serves as a cumulative upgrade for Red Hat JBoss Data
Virtualization 6.0.0. It includes various bug fixes, which are listed in
the README file included with the patch files.
The following security issues are also fixed with this release:
It was found that Odata4j permitted XML eXternal Entity (XXE) attacks. If a
REST endpoint was deployed, a remote attacker could submit a request
containing an external XML entity that, when resolved, allowed that
attacker to read files on the application server in the context of the user
running that server. (CVE-2014-0171)
The HawtJNI Library class wrote native libraries to a predictable file name
in /tmp when the native libraries were bundled in a JAR file, and no custom
library path was specified. A local attacker could overwrite these native
libraries with malicious versions during the window between when HawtJNI
writes them and when they are executed. (CVE-2013-2035)
It was found that the security audit functionality logged request
parameters in plain text. This may have caused passwords to be included in
the audit log files when using BASIC or FORM-based authentication. A local
attacker with access to audit log files could possibly use this flaw to
obtain application or server authentication credentials. (CVE-2014-0058)
The CVE-2014-0171 issue was discovered by David Jorm of Red Hat Product
Security; the CVE-2013-2035 issue was discovered by Florian Weimer of Red
Hat Product Security.
All users of Red Hat JBoss Data Virtualization 6.0.0 as provided from the
Red Hat Customer Portal are advised to apply this roll up patch.
3. Solution:
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing Red Hat JBoss Data Virtualization installation (including its
databases, applications, configuration files, and so on).
Note that it is recommended to halt the Red Hat JBoss Data Virtualization
server by stopping the JBoss Application Server process before installing
this update, and then after installing the update, restart the Red Hat
JBoss Data Virtualization server by starting the JBoss Application Server
process.
4. Bugs fixed (https://bugzilla.redhat.com/):
958618 - CVE-2013-2035 HawtJNI: predictable temporary file name leading to local arbitrary code execution
1063641 - CVE-2014-0058 Red Hat JBoss EAP6: Plain text password logging during security audit
1085555 - CVE-2014-0171 Odata4j: XML eXternal Entity (XXE) flaw
5. References:
https://access.redhat.com/security/cve/CVE-2013-2035
https://access.redhat.com/security/cve/CVE-2014-0058
https://access.redhat.com/security/cve/CVE-2014-0171
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.services.platform&downloadType=securityPatches&version=6.0.0
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2015 Red Hat, Inc.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVLRbEBLndAQH1ShLAQKktg/+Js5uYeihEopMerzvACw0o78Ca2WGRvvX
5Z8VwEoJPTbPbFLKh1TIik9de1PPO2hwEb8+BFKXe65DTBf59dsaTsRgSZJV7sx3
43pYMN/seBYhGJ5IZPFbDoJESKjnpuTPO3C41ZnGyIWnyaDp0g10tIJRtmzCA1fA
7HGQszYnPW5VmqknWYSVfBwvMfG3BpjsbQaVs3suis4rCNYR+ssTnmVxU08BAY8I
o+4xFefak2uK7mRKvu5Bhr5OXpeJjvxG5p+HaZqWbVQdWeU8E4BfDXx1SwiTVBcJ
1o4AT1hmdyy3UgPLG1902PKYY72TFXG23A9yU2/YManbbFDpt0XJZ0sV8lUHWJ85
FQ8TYDpV8pj2QhCdLr0spXFhfkSo86WvgPqan+i9LTxPMcTJgnUs36Bs15MfA49E
QFDsXtHN/FN2Q2O/pmZhsn+LkEMjBErkaLOnmH1hY5TICxm9clI9mniUCGq+gwv8
gvCIqX8EwMEri9MLeG4nhIudzXKElsh2sE8n9VnzhM26RwxmHyOuYw61/Uzsbk+4
V7JMVynaCxh+YgY6HPcLqHeHKDoFdnwcdqKbBAMqId3HYsVHV89K6a1tygvRoLie
WHRFRIuFYtB3/UJIwG+ewO9lFn+a89n2sS/8P+2LCoFgjX6PLOARB8moPXyUZer+
Vurn2iW+VUA=
=eaVs
-----END PGP SIGNATURE-----