JBoss Enterprise Application Platform Multiple Remote Vulnerabilities

Bugtraq ID:	45148
Class:	Input Validation Error
CVE:	CVE-2010-3708 CVE-2010-3862 CVE-2010-3878 CVE-2010-4265
Remote:	Yes
Local:	No
Published:	Dec 01 2010 12:00AM
Updated:	Dec 08 2010 08:05PM
Credit:	Reported by the vendor and Ole Husgaard.
Vulnerable:	Red Hat JBoss Enterprise Web Platform for RHEL 5 Server 5 Red Hat JBoss Enterprise Web Platform for RHEL 4ES 5 Red Hat JBoss Enterprise Web Platform for RHEL 4AS 5 Red Hat JBoss Enterprise Web Platform 5.1.0 Red Hat JBoss Enterprise Application Platform for RHEL 5 Server 5 Red Hat JBoss Enterprise Application Platform for RHEL 4ES 5 Red Hat JBoss Enterprise Application Platform for RHEL 4AS 5 Red Hat JBoss Enterprise Application Platform 4.3 EL5 Red Hat JBoss Enterprise Application Platform 4.3 EL4 Red Hat JBoss Enterprise Application Platform 4.3 Red Hat JBoss Enterprise Application Platform 5.1.0
Not Vulnerable:

JBoss Enterprise Application Platform Multiple Remote Vulnerabilities

The JBoss Enterprise Application Platform is prone to multiple vulnerabilities, including a remote code-execution issue, a remote denial-of-service issue, and a cross-site request-forgery issue.

Successful exploits can allow attackers to execute arbitrary code within the context of the affected application, perform certain administrative actions, deploy arbitrary WAR files on the server, or cause denial-of-service conditions; other attacks may also be possible.

These issues affect JBoss Enterprise Application Platform 4.3.0; other versions may also be affected.

JBoss Enterprise Application Platform Multiple Remote Vulnerabilities

Attackers can exploit these issues via a browser.

JBoss Enterprise Application Platform Multiple Remote Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

JBoss Enterprise Application Platform Multiple Remote Vulnerabilities

References:

• JBoss Enterprise Application Platform Homepage (Red Hat)