Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2015.1990
Moderate: Red Hat JBoss Operations Network 3.3.3 update
31 July 2015
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Red Hat JBoss Operations Network
Publisher: Red Hat
Operating System: Red Hat
Windows
Solaris
Impact/Access: Cross-site Scripting -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2015-3267
Original Bulletin:
https://rhn.redhat.com/errata/RHSA-2015-1525.html
Comment: This advisory references vulnerabilities in products which run on
platforms other than Red Hat. It is recommended that administrators
running Red Hat JBoss Operations Network check for an updated
version of the software for their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat JBoss Operations Network 3.3.3 update
Advisory ID: RHSA-2015:1525-01
Product: Red Hat JBoss Operations Network
Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1525.html
Issue date: 2015-07-30
CVE Names: CVE-2015-3267
=====================================================================
1. Summary:
Red Hat JBoss Operations Network 3.3 update 3, which fixes one security
issue and several bugs, is now available from the Red Hat Customer Portal.
Red Hat Product Security has rated this update as having Moderate security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.
2. Description:
Red Hat JBoss Operations Network is a Middleware management solution that
provides a single point of control to deploy, manage, and monitor JBoss
Enterprise Middleware, applications, and services.
This JBoss Operations Network 3.3.3 release serves as a replacement for
JBoss Operations Network 3.3.2, and includes several bug fixes. Refer to
the Customer Portal page linked in the References section for information
on the most significant of these changes.
The following security issue is also fixed with this release:
It was discovered that a cross-site scripting (XSS) vulnerability on a
JBoss Operations Network 404 error page allowed for session fixation
attacks. An attacker could use this flaw to impersonate a legitimate user,
resulting in compromised integrity of secure data. (CVE-2015-3267)
All users of JBoss Operations Network 3.3.2 as provided from the Red Hat
Customer Portal are advised to upgrade to JBoss Operations Network 3.3.3.
3. Solution:
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss Operations Network installation (including its databases,
applications, configuration files, the JBoss Operations Network server's
file system directory, and so on).
Refer to the JBoss Operations Network 3.3.3 Release Notes for
installation information.
4. Bugs fixed (https://bugzilla.redhat.com/):
652800 - Unable to use parentheses in search filters for LDAP configuration
1113044 - Jboss-on-agent packages conflicts in jbappplatform-6-i386-server-6-rpm RHN channel
1173096 - Support for Filtering child resources
1173164 - Globally uncaught Exception shown in the JBoss ON UI when trying to display orphaned operation schedule
1180343 - JBoss ON server installer incorrectly requires storage node to be installed locally
1187527 - It's not possible to add a standalone storage node
1194638 - no patched log created when user does not have permission to apply patch
1202760 - Next execution link in "Scheduled Operations" portlet is not correct
1207263 - Dashboard portlet of memory heap does not have breadcrumb
1207276 - Uninventory of platform always display a message "You are going to uninventory at least one resource that may be used by the storage cluster" when its not.
1208854 - Unable to stop storage node when running on IBM SDK 8
1209558 - RtFilter never load vHostMappingFile from absolute or relative path in EAP 6
1211407 - Agent plug-in deletion fails if resource group or auto-group operation was used
1212022 - unable to deploy package from repository if type is not File:Deployment/DomainDeployment
1212627 - Server fails to reconnect to storage node
1212853 - Failure saving measurement trait data - value too long for type character varying(4000)
1212878 - Cannot obtain client connection to the RHQ app server while upgrading JON server
1212933 - Resource start operation leads to broken managed server
1212950 - EAP 6 start operation causes agent to run out of memory due to storing console output in an unused buffer
1213366 - Could not complete storage cluster schema installation due to NoClassDefFoundError
1213782 - Could not complete storage cluster schema installation: java.lang.NullPointerException
1215648 - Reverse proxy in front of JBoss ON does not render the login page but shows the html source of the page
1220816 - Attempt to associate the HTTP content source with repository displays JBWEB000065: HTTP Status 404 error
1221288 - Impossible to send Notifications to a Group
1221745 - Recent Alerts and Operations portlets are not sortable
1225448 - Unable to add package type to content source
1225492 - XHTML files contain errorprone javascript calls
1232006 - Agent does not start if RHQ_AGENT_JAVA_OPTS is set in rhq-agent-env.sh
1233991 - Creation and group association of bundle fails with IllegalArgumentException: Token did not result in valid file
1237155 - CVE-2015-3267 JON: Cross Site scripting possible on the JBoss ON 404 error page
5. References:
https://access.redhat.com/security/cve/CVE-2015-3267
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em&downloadType=securityPatches&version=3.3
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2015 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFVulvYXlSAg2UNWIIRAhD9AJ4sakTPkfENoHd5Pm+sd2pSwWmJbgCcCPjF
8qECsrBSUDwsO8I7sCXQkO0=
=Hf7S
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVbq8wn6ZAP0PgtI9AQIhyQ/7BvtoIFaDuy1HKrR8BSz0JWs50Yooi3nP
9t9peTNo9Tcm5jg72L0DTHWPRgsor0srQKitfmcYkMX1+TerTLqiMv3dZTmDz3l2
n6ELB4TFWS7IWbzI1W1e6zvvRVyV3IDznT7pTRZwRs9tnV1T7/7fi2pJEc2zHjq6
4MUhc1DhJ+46HCm5ImWxJCKpf3S02vr0IqC9lgw5e2wbK15iCmiAu0I6BstcxxSV
xZangat1a8JAAT5hP5ZCmalk4jnD0a63ogaVAmd3zxvdxKmAUTugQkI3Y2ELdm8n
Qbv+X8PPF4qVzTrmbF6mxAgiZmY4wciQRZNoTbgNCuG6I5V2q7JfuamW2rfhhLur
LS5rcuhNRS1C2+yyR05p06jUBHkFjExl9p66E/46wb8Vo5VXOMhLM0cT6uDQ1EFr
DbgeLagvxF8bXz4VEXbLMd2CnFH9/yCJmR6HEEJIDwYIEYKO7VWWCXQn6vQbzrvf
Xp7jTnDsKYrxDODRxhSV9kpK+v2rdAQlrqn9Klllgc8Lnnxu4LSonchnqK+ZtV98
wqbZmoQxQPPqlheJL/1vf5Ar7vCUgHGKkZhULKEGLEnzSUpD+I0aj4/PuZoj2TWy
X64NFvv9tfxmdeRPAqN6GD3hZxiWlNNffZGpa9nrCm9OoM5XjDbvpMYFXmgfhLN1
tXfOfj9B99w=
=9Rcz
-----END PGP SIGNATURE-----