[RHSA-2016:2056-01] Important: Red Hat JBoss Enterprise Application Platform 6.4.10 update

Wed Oct 12 17:19:59 UTC 2016

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat JBoss Enterprise Application Platform 6.4.10 update
Advisory ID:       RHSA-2016:2056-01
Product:           Red Hat JBoss Enterprise Application Platform
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2016-2056.html
Issue date:        2016-10-12
CVE Names:         CVE-2015-3183 CVE-2015-3195 CVE-2015-4000 
                   CVE-2016-2105 CVE-2016-2106 CVE-2016-2108 
                   CVE-2016-2109 CVE-2016-3110 CVE-2016-4459 
=====================================================================

1. Summary:

An update is now available for Red Hat JBoss Enterprise Application
Platform.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java
applications based on JBoss Application Server 7.

This release includes bug fixes and enhancements, as well as a new release
of OpenSSL that addresses a number of outstanding security flaws. For
further information, see the knowledge base article linked to in the
References section. All users of Red Hat JBoss Enterprise Application
Platform 6.4 on Red Hat Enterprise Linux 6 are advised to upgrade to these
updated packages.

Security Fix(es):

* A flaw was found in the way OpenSSL encoded certain ASN.1 data
structures. An attacker could use this flaw to create a specially crafted
certificate which, when verified or re-encoded by OpenSSL, could cause it
to crash, or execute arbitrary code using the permissions of the user
running an application compiled against the OpenSSL library.
(CVE-2016-2108)

* Multiple flaws were found in the way httpd parsed HTTP requests and
responses using chunked transfer encoding. A remote attacker could use
these flaws to create a specially crafted request, which httpd would decode
differently from an HTTP proxy software in front of it, possibly leading to
HTTP request smuggling attacks. (CVE-2015-3183)

* A memory leak vulnerability was found in the way OpenSSL parsed PKCS#7
and CMS data. A remote attacker could use this flaw to cause an application
that parses PKCS#7 or CMS data from untrusted sources to use an excessive
amount of memory and possibly crash. (CVE-2015-3195)

* A flaw was found in the way the TLS protocol composes the Diffie-Hellman
exchange (for both export and non-export grade cipher suites). An attacker
could use this flaw to downgrade a DHE connection to use export-grade key
sizes, which could then be broken by sufficient pre-computation. This can
lead to a passive man-in-the-middle attack in which the attacker is able to
decrypt all traffic. (CVE-2015-4000)

* An integer overflow flaw, leading to a buffer overflow, was found in the
way the EVP_EncodeUpdate() function of OpenSSL parsed very large amounts of
input data. A remote attacker could use this flaw to crash an application
using OpenSSL or, possibly, execute arbitrary code with the permissions of
the user running that application. (CVE-2016-2105)

* An integer overflow flaw, leading to a buffer overflow, was found in the
way the EVP_EncryptUpdate() function of OpenSSL parsed very large amounts
of input data. A remote attacker could use this flaw to crash an
application using OpenSSL or, possibly, execute arbitrary code with the
permissions of the user running that application. (CVE-2016-2106)

* It was discovered that it is possible to remotely Segfault Apache http
server with a specially crafted string sent to the mod_cluster via service
messages (MCMP). (CVE-2016-3110)

* A denial of service flaw was found in the way OpenSSL parsed certain
ASN.1-encoded data from BIO (OpenSSL's I/O abstraction) inputs. An
application using OpenSSL that accepts untrusted ASN.1 BIO input could be
forced to allocate an excessive amount of data. (CVE-2016-2109)

* It was discovered that specifying configuration with a JVMRoute path
longer than 80 characters will cause segmentation fault leading to a server
crash. (CVE-2016-4459)

Red Hat would like to thank the OpenSSL project for reporting
CVE-2016-2108, CVE-2016-2105, and CVE-2016-2106 and Michal Karm Babacek for
reporting CVE-2016-3110. The CVE-2016-4459 issue was discovered by Robert
Bost (Red Hat). Upstream acknowledges Huzaifa Sidhpurwala (Red Hat), Hanno
Böck, and David Benjamin (Google) as the original reporters of
CVE-2016-2108; and Guido Vranken as the original reporter of CVE-2016-2105
and CVE-2016-2106.

3. Solution:

Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1223211 - CVE-2015-4000 LOGJAM: TLS connections which support export grade DHE key-exchange are vulnerable to MITM attacks
1243887 - CVE-2015-3183 httpd: HTTP request smuggling attack against chunked request parser
1288322 - CVE-2015-3195 OpenSSL: X509_ATTRIBUTE memory leak
1326320 - CVE-2016-3110 mod_cluster: remotely Segfault Apache http server
1330101 - CVE-2016-2109 openssl: ASN.1 BIO handling of large amounts of data
1331402 - CVE-2016-2108 openssl: Memory corruption in the ASN.1 encoder
1331441 - CVE-2016-2105 openssl: EVP_EncodeUpdate overflow
1331536 - CVE-2016-2106 openssl: EVP_EncryptUpdate overflow
1341583 - CVE-2016-4459 mod_cluster: Buffer overflow in mod_manager when sending request with long JVMRoute

5. References:

https://access.redhat.com/security/cve/CVE-2015-3183
https://access.redhat.com/security/cve/CVE-2015-3195
https://access.redhat.com/security/cve/CVE-2015-4000
https://access.redhat.com/security/cve/CVE-2016-2105
https://access.redhat.com/security/cve/CVE-2016-2106
https://access.redhat.com/security/cve/CVE-2016-2108
https://access.redhat.com/security/cve/CVE-2016-2109
https://access.redhat.com/security/cve/CVE-2016-3110
https://access.redhat.com/security/cve/CVE-2016-4459
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/articles/2688611
https://access.redhat.com/solutions/222023
https://access.redhat.com/documentation/en/jboss-enterprise-application-platform/
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.4

6. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFX/nC9XlSAg2UNWIIRAnxyAJ9e/4EllYuokmkD6tLkfhHL3pZ0mQCgh8zG
yB8E4qH53UH71bMzQwek8yU=
=eQHg
-----END PGP SIGNATURE-----