Red Hat JBoss EAP 6.2.1 Fixes XXE, XML DoS, and Service-Registry Access Flaws
Patch & Detection Intelligence · 30 sources · Updated 2mo ago · First seen Apr 30, 2014
Red Hat released JBoss Enterprise Application Platform (EAP) 6.2.1 to replace EAP 6.2.0 and remediate three Moderate-impact vulnerabilities. CVE-2013-6440 affects OpenSAML/XMLTooling-J and allows externally supplied XML entities to be resolved, potentially enabling unauthenticated remote attackers to read files accessible to the application-server account and conduct further XXE attacks. CVE-2013-4517 affects Apache Santuario XML Security for Java, where DTD processing during XML transforms can exhaust memory and cause an OutOfMemoryError. CVE-2014-0018 permits deployed code running under a Java Security Manager to access the Modular Service Container service registry without required permission checks and alter JBoss internal server state.
The fixes were delivered through RHSA-2014:0170 for RHEL 5, RHSA-2014:0171 for RHEL 6, and RHSA-2014:0172 for Customer Portal distributions. Organizations operating EAP 6.2.0 should upgrade to EAP 6.2.1, back up installations and deployed applications, review and merge locally modified configuration files preserved as .rpmnew where applicable, and restart the JBoss server process after installation.
