PT-2014-3120 · Red Hat · Jboss Seam

Jon Passki · Published 2014-01-23 · Updated 2014-01-23 · CVE-2013-6447

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JBoss Seam 2 framework versions 2.3.1 and earlier

Description The issue concerns Multiple XML External Entity (XXE) vulnerabilities in certain classes of JBoss Seam Remoting. These vulnerabilities allow remote attackers to read arbitrary files and possibly have other impacts via a crafted XML file. The affected classes include ExecutionHandler, PollHandler, and SubscriptionHandler.

Recommendations For JBoss Seam 2 framework versions 2.3.1 and earlier, consider updating to a version that addresses these XXE vulnerabilities. As a temporary workaround, restrict access to the ExecutionHandler, PollHandler, and SubscriptionHandler classes to minimize the risk of exploitation. Avoid processing crafted XML files until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-6447

Affected Products

Jboss Seam

References · 6

• http://secunia.com/advisories/56572 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0045.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6447 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1044784 · Vendor Advisory
• https://github.com/seam2/jboss-seam/commit/090aa6252affc978a96c388e3fc2c1c2688d9bb5 · Note
• http://securitytracker.com/id/1029652 · Note