[RHSA-2013:1045-01] Critical: RichFaces security update

[bugzilla at redhat.com]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: RichFaces security update
Advisory ID:       RHSA-2013:1045-01
Product:           Red Hat JBoss Middleware
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2013-1045.html
Issue date:        2013-07-11
CVE Names:         CVE-2013-2165 
=====================================================================

1. Summary:

An update for the RichFaces component that fixes one security issue is now
available from the Red Hat Customer Portal for Red Hat JBoss Enterprise
Application Platform 4.3.0 CP10 and 5.2.0; Red Hat JBoss Web Platform
5.2.0; Red Hat JBoss BRMS 5.3.1; Red Hat JBoss SOA Platform 4.3.0 CP05 and
5.3.1; Red Hat JBoss Portal 4.3 CP07 and 5.2.2; and Red Hat JBoss
Operations Network 2.4.2 and 3.1.2.

The Red Hat Security Response Team has rated this update as having critical
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

2. Description:

RichFaces is an open source framework that adds Ajax capability into
existing JavaServer Faces (JSF) applications.

A flaw was found in the way RichFaces ResourceBuilderImpl handled
deserialization. A remote attacker could use this flaw to trigger the
execution of the deserialization methods in any serializable class deployed
on the server. This could lead to a variety of security impacts depending
on the deserialization logic of these classes. (CVE-2013-2165)

The fix for this issue introduces a whitelist to limit classes that can be
deserialized by RichFaces.

If you require to whitelist a class that is not already listed, for
example, a custom class, you can achieve this by following one of these
methods:

Method 1: Implementing the SerializableResource interface.
In RichFaces 3, this is defined at
org.ajax4jsf.resource.SerializableResource and in RichFaces 4/5, at
org.richfaces.resource.SerializableResource.

Method 2: Adding the class to the resource-serialization.properties file
(a default properties file is provided once this update is applied).
To do this you can extend the framework provided properties file that is
available under org.ajax4jsf.resource in RichFaces 3 and
org.richfaces.resource in RichFaces 4/5. The modified properties file has
to be copied into the classpath of your deployment under the
version-specific packages.

Where possible, it is recommended that Method 1 be followed.

Red Hat would like to thank Takeshi Terada (Mitsui Bussan Secure
Directions, Inc.) for reporting this issue.

Warning: Before applying this update, back up your existing installation,
including all applications, configuration files, databases and database
settings, and so on. For Red Hat JBoss Operations Network, also back up
the Red Hat JBoss Operations Network server's file system directory.

All users of the affected products as provided from the Red Hat Customer
Portal are advised to apply this update.

3. Solution:

The References section of this erratum contains download links (you must
log in to download the updates). Before applying the updates, back up your
existing installation, including all applications, configuration files,
databases and database settings, and so on. For Red Hat JBoss Operations
Network, also back up the Red Hat JBoss Operations Network server's file
system directory.

For Red Hat JBoss BRMS, Red Hat JBoss SOA Platform, and Red Hat JBoss
Portal, it is recommended to halt the server by stopping the JBoss
Application Server process before installing this update, and then after
installing the update, restart the server by starting the JBoss Application
Server process.

Refer to the Red Hat JBoss Operations Network Release Notes for
installation information.

The JBoss server process must be restarted for this update to take effect.

4. Bugs fixed (http://bugzilla.redhat.com/):

973570 - CVE-2013-2165 JBoss RichFaces: Remote code execution due to insecure deserialization

5. References:

https://www.redhat.com/security/data/cve/CVE-2013-2165.html
https://access.redhat.com/security/updates/classification/#critical
https://access.redhat.com/site/documentation/
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches&product=appplatform&version=5.2.0
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches&product=appplatform&version=4.3.0.GA_CP10
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=enterpriseweb.platform&downloadType=securityPatches&version=5.2.0
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms&downloadType=securityPatches&version=5.3.1
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform&downloadType=securityPatches&version=5.3.1+GA
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches&product=soaplatform&version=4.3.0.GA_CP05
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal&downloadType=securityPatches&version=5.2.2
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal&downloadType=securityPatches&version=4.3+CP07
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em&downloadType=securityPatches&version=3.1.2
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches&product=em&version=2.4.2

6. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2013 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFR3g8EXlSAg2UNWIIRAkMDAJwIujkAfpbDxw6QBYZBseJWPXu+DwCfd3xg
jLAr2X/y0xrZFh3Pc8Alcd0=
=gnqQ
-----END PGP SIGNATURE-----