RHEL 6Red Hat JBoss Enterprise Application Platform 6.4.0 更新重要 (RHSA-2015:0847)
high Nessus 插件 ID 82896
语言：
简介
远程 Red Hat 主机缺少一个或多个安全更新。描述
远程 Redhat Enterprise Linux 6 主机上安装的程序包受到 RHSA-2015:0847 公告中提及的多个漏洞的影响。Red Hat JBoss Enterprise Application Platform 6 是适用于基于 JBoss Application Server 7 的 Java 应用程序的平台。
已发现 Apache WSS4J 中之前用于针对 XML 加密的 Bleichenbacher 攻击 (CVE-2011-2487) 的对策会抛出异常，允许攻击者确定攻击尝试是否失败，并因此使得 WSS4J 容易遭到攻击。
原始缺陷允许远程攻击者恢复对称密钥的整个明文形式。 (CVE-2015-0226)
已发现 Apache WSS4J 允许通过 XML 签名封装攻击绕过 requireSignedEncryptedDataElements 配置属性。远程攻击者可利用此缺陷修改已签名请求的内容。 (CVE-2015-0227)
已发现之前 JkMount 规则子树的 JkUnmount 规则可能被忽略。这可能允许远程攻击者访问否则无法访问的树中的私有项目。 (CVE-2014-8111)
在 PicketLink 的 Service Provider 和 Identity Provider 处理某些请求的方式中发现缺陷。远程攻击者可利用此缺陷通过 PicketLink 登录到受害者帐户。 (CVE-2015-0277)
已发现 Red Hat Enterprise Application Platform 提供的命令行界面会在用户主目录中创建名为 .jboss-cli-history 的历史文件，其默认文件权限不安全。这可允许恶意的本地用户获取否则无法访问的信息。 (CVE-2014-3586)
CVE-2015-0277 问题由 Red Hat 的 Ondrej Kotek 发现。
此版本的 JBoss Enterprise Application Platform 也包括缺陷补丁和增强功能。很快将可在“参考”部分链接的 JBoss Enterprise Application Platform 6.4.0 版本说明中查看这些更改的文档。
在 Red Hat Enterprise Linux 6 上需要 JBoss Enterprise Application Platform 6.4.0 的所有用户应安装这些新程序包。必须重新启动 JBoss 服务器进程才能使更新生效。
Tenable 已直接从 Red Hat Enterprise Linux 安全公告中提取上述描述块。
请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。
解决方案
更新受影响的程序包。另见
http://www.nessus.org/u?5f636a44
http://www.nessus.org/u?f88d6eb5
https://access.redhat.com/errata/RHSA-2015:0847
https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=1126687
https://bugzilla.redhat.com/show_bug.cgi?id=1155444
https://bugzilla.redhat.com/show_bug.cgi?id=1158977
https://bugzilla.redhat.com/show_bug.cgi?id=1165219
https://bugzilla.redhat.com/show_bug.cgi?id=1165227
https://bugzilla.redhat.com/show_bug.cgi?id=1166454
https://bugzilla.redhat.com/show_bug.cgi?id=1166744
https://bugzilla.redhat.com/show_bug.cgi?id=1167393
https://bugzilla.redhat.com/show_bug.cgi?id=1167918
https://bugzilla.redhat.com/show_bug.cgi?id=1167925
https://bugzilla.redhat.com/show_bug.cgi?id=1179789
https://bugzilla.redhat.com/show_bug.cgi?id=1179829
https://bugzilla.redhat.com/show_bug.cgi?id=1179836
https://bugzilla.redhat.com/show_bug.cgi?id=1179843
https://bugzilla.redhat.com/show_bug.cgi?id=1179846
https://bugzilla.redhat.com/show_bug.cgi?id=1182591
https://bugzilla.redhat.com/show_bug.cgi?id=1182973
https://bugzilla.redhat.com/show_bug.cgi?id=1182979
https://bugzilla.redhat.com/show_bug.cgi?id=1182983
https://bugzilla.redhat.com/show_bug.cgi?id=1182989
https://bugzilla.redhat.com/show_bug.cgi?id=1182992
https://bugzilla.redhat.com/show_bug.cgi?id=1182994
https://bugzilla.redhat.com/show_bug.cgi?id=1182998
https://bugzilla.redhat.com/show_bug.cgi?id=1188722
https://bugzilla.redhat.com/show_bug.cgi?id=1188725
https://bugzilla.redhat.com/show_bug.cgi?id=1188729
https://bugzilla.redhat.com/show_bug.cgi?id=1188734
https://bugzilla.redhat.com/show_bug.cgi?id=1188937
https://bugzilla.redhat.com/show_bug.cgi?id=1188944
https://bugzilla.redhat.com/show_bug.cgi?id=1188951
https://bugzilla.redhat.com/show_bug.cgi?id=1188957
https://bugzilla.redhat.com/show_bug.cgi?id=1188965
https://bugzilla.redhat.com/show_bug.cgi?id=1188976
https://bugzilla.redhat.com/show_bug.cgi?id=1188983
https://bugzilla.redhat.com/show_bug.cgi?id=1188986
https://bugzilla.redhat.com/show_bug.cgi?id=1188989
https://bugzilla.redhat.com/show_bug.cgi?id=1188992
https://bugzilla.redhat.com/show_bug.cgi?id=1191446
https://bugzilla.redhat.com/show_bug.cgi?id=1191451
https://bugzilla.redhat.com/show_bug.cgi?id=1194832
https://bugzilla.redhat.com/show_bug.cgi?id=1195908
https://bugzilla.redhat.com/show_bug.cgi?id=1195911
https://bugzilla.redhat.com/show_bug.cgi?id=1195916
https://bugzilla.redhat.com/show_bug.cgi?id=1195921
https://bugzilla.redhat.com/show_bug.cgi?id=1195924
https://bugzilla.redhat.com/show_bug.cgi?id=1195927
https://bugzilla.redhat.com/show_bug.cgi?id=1195930
https://bugzilla.redhat.com/show_bug.cgi?id=1195933
https://bugzilla.redhat.com/show_bug.cgi?id=1195936
https://bugzilla.redhat.com/show_bug.cgi?id=1195941
插件详情
严重性: High
ID: 82896
文件名: redhat-RHSA-2015-0847.nasl
版本: 1.20
类型: local
代理: unix
发布时间: 2015/4/20
最近更新时间: 2025/4/29
支持的传感器: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus
风险信息
VPR
风险因素: Medium
分数: 5.9
Vendor
Vendor Severity: Important
CVSS v2
风险因素: Medium
基本分数: 6
时间分数: 4.4
矢量: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSS 分数来源: CVE-2015-6254
CVSS v3
风险因素: High
基本分数: 7.5
时间分数: 6.5
矢量: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
时间矢量: CVSS:3.0/E:U/RL:O/RC:C
CVSS 分数来源: CVE-2015-0226
漏洞信息
CPE: p-cpe:/a:redhat:enterprise_linux:jboss-jaspi-api_1.0_spec, p-cpe:/a:redhat:enterprise_linux:httpcomponents-client-eap6, p-cpe:/a:redhat:enterprise_linux:picketlink-bindings, p-cpe:/a:redhat:enterprise_linux:jboss-rmi-api_1.0_spec, p-cpe:/a:redhat:enterprise_linux:apache-commons-lang-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-servlet-api_3.0_spec, p-cpe:/a:redhat:enterprise_linux:org.osgi.enterprise-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-osgi-logging, cpe:/o:redhat:enterprise_linux:6, p-cpe:/a:redhat:enterprise_linux:jboss-xnio-base, p-cpe:/a:redhat:enterprise_linux:jboss-as-appclient, p-cpe:/a:redhat:enterprise_linux:rngom-eap6, p-cpe:/a:redhat:enterprise_linux:apache-commons-pool-eap6, p-cpe:/a:redhat:enterprise_linux:tomcat-native, p-cpe:/a:redhat:enterprise_linux:xml-commons-resolver-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-as-client-all, p-cpe:/a:redhat:enterprise_linux:jboss-j2eemgmt-api_1.1_spec, p-cpe:/a:redhat:enterprise_linux:jboss-as-messaging, p-cpe:/a:redhat:enterprise_linux:jboss-aesh, p-cpe:/a:redhat:enterprise_linux:jboss-as-osgi-configadmin, p-cpe:/a:redhat:enterprise_linux:glassfish-jaf, p-cpe:/a:redhat:enterprise_linux:picketlink-federation, p-cpe:/a:redhat:enterprise_linux:jboss-as-logging, p-cpe:/a:redhat:enterprise_linux:jboss-hal, p-cpe:/a:redhat:enterprise_linux:jbossas-jbossweb-native, p-cpe:/a:redhat:enterprise_linux:jboss-as-picketlink, p-cpe:/a:redhat:enterprise_linux:mod_cluster, p-cpe:/a:redhat:enterprise_linux:jboss-as-version, p-cpe:/a:redhat:enterprise_linux:velocity-eap6, p-cpe:/a:redhat:enterprise_linux:atinject-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-jaxr-api_1.0_spec, p-cpe:/a:redhat:enterprise_linux:jboss-as-deployment-repository, p-cpe:/a:redhat:enterprise_linux:jboss-as-deployment-scanner, p-cpe:/a:redhat:enterprise_linux:jboss-as-network, p-cpe:/a:redhat:enterprise_linux:jansi-eap6, p-cpe:/a:redhat:enterprise_linux:picketbox, p-cpe:/a:redhat:enterprise_linux:ironjacamar-common-api-eap6, p-cpe:/a:redhat:enterprise_linux:org.osgi.core-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-logmanager, p-cpe:/a:redhat:enterprise_linux:objectweb-asm-eap6, p-cpe:/a:redhat:enterprise_linux:httpd-manual, p-cpe:/a:redhat:enterprise_linux:jboss-annotations-api_1.1_spec, p-cpe:/a:redhat:enterprise_linux:apache-mime4j, p-cpe:/a:redhat:enterprise_linux:infinispan-cachestore-remote, p-cpe:/a:redhat:enterprise_linux:jbosgi-vfs, p-cpe:/a:redhat:enterprise_linux:jboss-servlet-api_2.5_spec, p-cpe:/a:redhat:enterprise_linux:httpcomponents-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-as-jaxrs, p-cpe:/a:redhat:enterprise_linux:apache-commons-cli-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-as-sar, p-cpe:/a:redhat:enterprise_linux:jbosgi-deployment, p-cpe:/a:redhat:enterprise_linux:jboss-iiop-client, p-cpe:/a:redhat:enterprise_linux:jboss-interceptors-api_1.1_spec, p-cpe:/a:redhat:enterprise_linux:hibernate4-eap6, p-cpe:/a:redhat:enterprise_linux:ironjacamar-jdbc-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-as-domain-management, p-cpe:/a:redhat:enterprise_linux:jboss-jms-api_1.1_spec, p-cpe:/a:redhat:enterprise_linux:jboss-transaction-api_1.1_spec, p-cpe:/a:redhat:enterprise_linux:hibernate4-envers-eap6, p-cpe:/a:redhat:enterprise_linux:weld-cdi-1.0-api, p-cpe:/a:redhat:enterprise_linux:jboss-as-ee, p-cpe:/a:redhat:enterprise_linux:jboss-connector-api_1.6_spec, p-cpe:/a:redhat:enterprise_linux:hibernate-beanvalidation-api, p-cpe:/a:redhat:enterprise_linux:ironjacamar-core-api-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-jaxrs-api_1.1_spec, p-cpe:/a:redhat:enterprise_linux:jboss-as-connector, p-cpe:/a:redhat:enterprise_linux:jbossas-bundles, p-cpe:/a:redhat:enterprise_linux:codehaus-jackson-xc, p-cpe:/a:redhat:enterprise_linux:mod_jk, p-cpe:/a:redhat:enterprise_linux:httpd, p-cpe:/a:redhat:enterprise_linux:relaxngdatatype-eap6, p-cpe:/a:redhat:enterprise_linux:staxmapper, p-cpe:/a:redhat:enterprise_linux:log4j-jboss-logmanager, p-cpe:/a:redhat:enterprise_linux:jboss-jsp-api_2.2_spec, p-cpe:/a:redhat:enterprise_linux:codehaus-jackson, p-cpe:/a:redhat:enterprise_linux:jbossas-standalone, p-cpe:/a:redhat:enterprise_linux:mod_rt, p-cpe:/a:redhat:enterprise_linux:jboss-as-process-controller, p-cpe:/a:redhat:enterprise_linux:jboss-as-ee-deployment, p-cpe:/a:redhat:enterprise_linux:jbossweb, p-cpe:/a:redhat:enterprise_linux:jboss-as-naming, p-cpe:/a:redhat:enterprise_linux:jboss-as-platform-mbean, p-cpe:/a:redhat:enterprise_linux:glassfish-javamail, p-cpe:/a:redhat:enterprise_linux:ironjacamar-deployers-common-eap6, p-cpe:/a:redhat:enterprise_linux:jbossas-core, p-cpe:/a:redhat:enterprise_linux:httpmime-eap6, p-cpe:/a:redhat:enterprise_linux:jbossts, p-cpe:/a:redhat:enterprise_linux:jboss-as-xts, p-cpe:/a:redhat:enterprise_linux:jboss-as-transactions, p-cpe:/a:redhat:enterprise_linux:jboss-as-webservices, p-cpe:/a:redhat:enterprise_linux:jboss-classfilewriter, p-cpe:/a:redhat:enterprise_linux:jboss-as-core-security, p-cpe:/a:redhat:enterprise_linux:jboss-as-osgi, p-cpe:/a:redhat:enterprise_linux:ironjacamar-common-impl-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-jaxrpc-api_1.1_spec, p-cpe:/a:redhat:enterprise_linux:jboss-as-jsr77, p-cpe:/a:redhat:enterprise_linux:jboss-common-beans, p-cpe:/a:redhat:enterprise_linux:hibernate4-core-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-as-domain-http, p-cpe:/a:redhat:enterprise_linux:jbossas-appclient, p-cpe:/a:redhat:enterprise_linux:jboss-as-embedded, p-cpe:/a:redhat:enterprise_linux:infinispan, p-cpe:/a:redhat:enterprise_linux:jul-to-slf4j-stub, p-cpe:/a:redhat:enterprise_linux:jbosgi-spi, p-cpe:/a:redhat:enterprise_linux:jboss-ejb-api_3.1_spec, p-cpe:/a:redhat:enterprise_linux:jboss-as-remoting, p-cpe:/a:redhat:enterprise_linux:jboss-as-jpa, p-cpe:/a:redhat:enterprise_linux:jboss-as-protocol, p-cpe:/a:redhat:enterprise_linux:jboss-as-controller-client, p-cpe:/a:redhat:enterprise_linux:jboss-as-jaxr, p-cpe:/a:redhat:enterprise_linux:jboss-as-jdr, p-cpe:/a:redhat:enterprise_linux:snakeyaml-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-ejb-client, p-cpe:/a:redhat:enterprise_linux:mod_ssl, p-cpe:/a:redhat:enterprise_linux:hibernate4-infinispan-eap6, p-cpe:/a:redhat:enterprise_linux:ecj-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-as-jsf, p-cpe:/a:redhat:enterprise_linux:picketbox-commons, p-cpe:/a:redhat:enterprise_linux:httpclient-eap6, p-cpe:/a:redhat:enterprise_linux:infinispan-cachestore-jdbc, p-cpe:/a:redhat:enterprise_linux:jboss-remote-naming, p-cpe:/a:redhat:enterprise_linux:jboss-weld-1.1-api, p-cpe:/a:redhat:enterprise_linux:codehaus-jackson-jaxrs, p-cpe:/a:redhat:enterprise_linux:jbossas-hornetq-native, p-cpe:/a:redhat:enterprise_linux:jboss-common-core, p-cpe:/a:redhat:enterprise_linux:jboss-as-pojo, p-cpe:/a:redhat:enterprise_linux:cal10n-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-metadata-ear, p-cpe:/a:redhat:enterprise_linux:infinispan-core, p-cpe:/a:redhat:enterprise_linux:jboss-as-weld, p-cpe:/a:redhat:enterprise_linux:jboss-as-clustering, p-cpe:/a:redhat:enterprise_linux:jcip-annotations-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-modules, p-cpe:/a:redhat:enterprise_linux:mod_cluster-demo, p-cpe:/a:redhat:enterprise_linux:jboss-logging, p-cpe:/a:redhat:enterprise_linux:sun-ws-metadata-2.0-api, p-cpe:/a:redhat:enterprise_linux:avro-eap6, p-cpe:/a:redhat:enterprise_linux:apache-commons-daemon-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-as-configadmin, p-cpe:/a:redhat:enterprise_linux:httpd-devel, p-cpe:/a:redhat:enterprise_linux:httpserver, p-cpe:/a:redhat:enterprise_linux:hibernate4-entitymanager-eap6, p-cpe:/a:redhat:enterprise_linux:httpcomponents-core-eap6, p-cpe:/a:redhat:enterprise_linux:jbossas-modules-eap, p-cpe:/a:redhat:enterprise_linux:jbossas-welcome-content-eap, p-cpe:/a:redhat:enterprise_linux:sun-xsom, p-cpe:/a:redhat:enterprise_linux:jboss-dmr, p-cpe:/a:redhat:enterprise_linux:jbossxb2, p-cpe:/a:redhat:enterprise_linux:jboss-as-controller, p-cpe:/a:redhat:enterprise_linux:httpcore-eap6, p-cpe:/a:redhat:enterprise_linux:joda-time-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-metadata-ejb, p-cpe:/a:redhat:enterprise_linux:codehaus-jackson-mapper-asl, p-cpe:/a:redhat:enterprise_linux:jboss-as-threads, p-cpe:/a:redhat:enterprise_linux:jbosgi-resolver, p-cpe:/a:redhat:enterprise_linux:jdom-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-jaxb-api_2.2_spec, p-cpe:/a:redhat:enterprise_linux:hibernate-jpa-2.0-api, p-cpe:/a:redhat:enterprise_linux:jboss-as-osgi-service, p-cpe:/a:redhat:enterprise_linux:jboss-genericjms, p-cpe:/a:redhat:enterprise_linux:jboss-as-jacorb, p-cpe:/a:redhat:enterprise_linux:httpcomponents-project-eap6, p-cpe:/a:redhat:enterprise_linux:glassfish-jsf12-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-as-management-client-content, p-cpe:/a:redhat:enterprise_linux:codehaus-jackson-core-asl, p-cpe:/a:redhat:enterprise_linux:jboss-as-server, p-cpe:/a:redhat:enterprise_linux:jboss-as-console, p-cpe:/a:redhat:enterprise_linux:mod_cluster-native, p-cpe:/a:redhat:enterprise_linux:jbossas-javadocs, p-cpe:/a:redhat:enterprise_linux:ironjacamar-spec-api-eap6, p-cpe:/a:redhat:enterprise_linux:ironjacamar-validator-eap6, p-cpe:/a:redhat:enterprise_linux:ironjacamar-core-impl-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-as-security, p-cpe:/a:redhat:enterprise_linux:jboss-as-cmp, p-cpe:/a:redhat:enterprise_linux:jboss-vfs2, p-cpe:/a:redhat:enterprise_linux:mod_snmp, p-cpe:/a:redhat:enterprise_linux:jandex-eap6, p-cpe:/a:redhat:enterprise_linux:jbosgi-metadata, p-cpe:/a:redhat:enterprise_linux:jboss-as-host-controller, p-cpe:/a:redhat:enterprise_linux:jboss-metadata-web, p-cpe:/a:redhat:enterprise_linux:jbossas-product-eap, p-cpe:/a:redhat:enterprise_linux:sun-txw2, p-cpe:/a:redhat:enterprise_linux:apache-commons-codec-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-jad-api_1.2_spec, p-cpe:/a:redhat:enterprise_linux:jboss-as-jmx, p-cpe:/a:redhat:enterprise_linux:hornetq-native, p-cpe:/a:redhat:enterprise_linux:jbosgi-framework-core, p-cpe:/a:redhat:enterprise_linux:hibernate4-search, p-cpe:/a:redhat:enterprise_linux:glassfish-jsf-eap6, p-cpe:/a:redhat:enterprise_linux:httpd-tools, p-cpe:/a:redhat:enterprise_linux:hornetq, p-cpe:/a:redhat:enterprise_linux:jboss-seam-int, p-cpe:/a:redhat:enterprise_linux:infinispan-client-hotrod, p-cpe:/a:redhat:enterprise_linux:ironjacamar-common-spi-eap6, p-cpe:/a:redhat:enterprise_linux:apache-commons-configuration-eap6, p-cpe:/a:redhat:enterprise_linux:jboss-as-cli, p-cpe:/a:redhat:enterprise_linux:jboss-metadata-common, p-cpe:/a:redhat:enterprise_linux:jboss-threads, p-cpe:/a:redhat:enterprise_linux:jbosgi-repository, p-cpe:/a:redhat:enterprise_linux:sun-codemodel, p-cpe:/a:redhat:enterprise_linux:apache-commons-io-eap6, p-cpe:/a:redhat:enterprise_linux:javassist-eap6, p-cpe:/a:redhat:enterprise_linux:resteasy, p-cpe:/a:redhat:enterprise_linux:mod_jk-ap22, p-cpe:/a:redhat:enterprise_linux:ironjacamar-eap6, p-cpe:/a:redhat:enterprise_linux:jbossas-domain, p-cpe:/a:redhat:enterprise_linux:jboss-as-web, p-cpe:/a:redhat:enterprise_linux:jboss-sasl, p-cpe:/a:redhat:enterprise_linux:hibernate3-commons-annotations, p-cpe:/a:redhat:enterprise_linux:jboss-as-modcluster, p-cpe:/a:redhat:enterprise_linux:lucene-solr, p-cpe:/a:redhat:enterprise_linux:jboss-as-mail, p-cpe:/a:redhat:enterprise_linux:jboss-metadata-appclient, p-cpe:/a:redhat:enterprise_linux:hibernate4-validator, p-cpe:/a:redhat:enterprise_linux:jboss-as-ejb3, p-cpe:/a:redhat:enterprise_linux:jboss-as-system-jmx, p-cpe:/a:redhat:enterprise_linux:jboss-metadata
必需的 KB 项: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
易利用性: No known exploits are available
补丁发布日期: 2015/4/16
漏洞发布日期: 2015/2/12
参考资料信息
CVE: CVE-2014-3586, CVE-2014-8111, CVE-2015-0226, CVE-2015-0227, CVE-2015-0277, CVE-2015-0298, CVE-2015-6254