Red Hat Security Advisory: JBoss Operations Network 3.1.1 update Security Advisory secalert@redhat.com Red Hat Security Response Team RHSA-2012:1331 Final 1 1 2012-10-03T15:08:00Z Current version 2012-10-03T15:08:00Z 2012-10-03T15:08:00Z Red Hat rhsa-to-cvrf 1.0.1484 2012-10-03T15:09:01Z JBoss Operations Network 3.1.1, which fixes one security issue, several bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. JBoss Operations Network (JBoss ON) is a middleware management solution that provides a single point of control to deploy, manage, and monitor JBoss Enterprise Middleware, applications, and services. This JBoss ON 3.1.1 release serves as a replacement for JBoss ON 3.1.0, and includes several bug fixes and enhancements. Refer to the JBoss ON 3.1.1 Release Notes for information on the most significant of these changes. The Release Notes will be available shortly from https://access.redhat.com/knowledge/docs/ The following security issue is also fixed with this release: It was found that JBoss Web did not handle large numbers of parameters and large parameter values efficiently. A remote attacker could make JBoss Web use an excessive amount of CPU time by sending an HTTP request containing a large number of parameters or large parameter values. This update introduces limits on the number of parameters and headers processed per request to address this issue. The default limit is 512 for parameters and 128 for headers. These defaults can be changed by setting the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties in "jbossas/server/[PROFILE]/deploy/properties-service.xml". (CVE-2012-0022) Warning: Before applying the update, back up your existing JBoss ON installation (including its databases, applications, configuration files, the JBoss ON server's file system directory, and so on). All users of JBoss Operations Network 3.1.0 as provided from the Red Hat Customer Portal are advised to upgrade to JBoss Operations Network 3.1.1. Please see https://www.redhat.com/footer/terms-of-use.html Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate https://rhn.redhat.com/errata/RHSA-2012-1331.html https://rhn.redhat.com/errata/RHSA-2012-1331.html https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/knowledge/docs/ https://access.redhat.com/knowledge/docs/ https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=em&version=3.1.1 https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=em&version=3.1.1 It was found that JBoss Web did not handle large numbers of parameters and large parameter values efficiently. A remote attacker could make JBoss Web use an excessive amount of CPU time by sending an HTTP request containing a large number of parameters or large parameter values. This update introduces limits on the number of parameters and headers processed per request to address this issue. The default limit is 512 for parameters and 128 for headers. These defaults can be changed by setting the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties in "jbossas/server/[PROFILE]/deploy/properties-service.xml". 2012-01-17T00:00:00Z 2012-01-17T00:00:00Z CVE-2012-0022 Moderate 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing JBoss ON installation (including its databases, applications, configuration files, the JBoss ON server's file system directory, and so on). Refer to the JBoss Operations Network 3.1.1 Release Notes for installation information. https://rhn.redhat.com/errata/RHSA-2012-1331.html https://www.redhat.com/security/data/cve/CVE-2012-0022.html CVE-2012-0022 https://bugzilla.redhat.com/show_bug.cgi?id=783359 bz#783359: CVE-2012-0022 tomcat: large number of parameters DoS Red Hat would like to thank oCERT for reporting this issue. oCERT acknowledges Julian Wälde and Alexander Klink as the original reporters.