U radu programskog paketa JBoss Enterprise BRMS Platform uočena su tri sigurnosna propusta koja udaljenim napadačima omogućuju zaobilaženje postavljenih ograničenja, otkrivanje osjetljivih informacija i izmjenu podataka.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: JBoss Enterprise BRMS Platform 5.3.0 update
Advisory ID:       RHSA-2012:1028-01
Product:           JBoss Enterprise Middleware
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2012-1028.html
Issue date:        2012-06-22
CVE Names:         CVE-2011-4085 CVE-2011-4605 CVE-2012-2377 
=====================================================================

1. Summary:

JBoss Enterprise BRMS Platform 5.3.0, which fixes multiple security issues,
various bugs, and adds enhancements is now available from the Red Hat
Customer Portal.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

2. Description:

JBoss Enterprise BRMS Platform is a business rules management system for
the management, storage, creation, modification, and deployment of JBoss
Rules. The Java Naming and Directory Interface (JNDI) Java API allows Java
software clients to locate objects or services in an application server.

This release of JBoss Enterprise BRMS Platform 5.3.0 serves as a
replacement for JBoss Enterprise BRMS Platform 5.2.0. It includes various
bug fixes and enhancements which are detailed in the JBoss Enterprise BRMS
Platform 5.3.0 Release Notes. The Release Notes will be available shortly
from https://docs.redhat.com/docs/en-US/index.html

The following security issues are also fixed with this release:

It was found that the JBoss JNDI service allowed unauthenticated, remote
write access by default. The JNDI and HA-JNDI services, and the
HAJNDIFactory invoker servlet were all affected. A remote attacker able to
access the JNDI service (port 1099), HA-JNDI service (port 1100), or the
HAJNDIFactory invoker servlet on a JBoss server could use this flaw to add,
delete, and modify items in the JNDI tree. This could have various,
application-specific impacts. (CVE-2011-4605)

It was found that the invoker servlets, deployed by default via
httpha-invoker, only performed access control on the HTTP GET and POST
methods, allowing remote attackers to make unauthenticated requests by
using different HTTP methods. Due to the second layer of authentication
provided by a security interceptor, this issue is not exploitable on
default installations unless an administrator has misconfigured the
security interceptor or disabled it. (CVE-2011-4085)

When a JGroups channel is started, the JGroups diagnostics service would be
enabled by default with no authentication. This service is exposed via IP
multicast. An attacker on an adjacent network could exploit this flaw to
read diagnostics information. (CVE-2012-2377)

Red Hat would like to thank Christian SchlÄ