Bug 994321 (CVE-2013-4210)

Summary:	CVE-2013-4210 Remoting: DoS by file descriptor exhaustion
Product:	[Other] Security Response	Reporter:	Arun Babu Neelicattu <aneelica>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	asantos, djorm, fnasser, grocha, hrupp, huwang, jlivings, lgao, loleary, mbabacek, mfoley, pcheung, security-response-team, spinder, theute, weli
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-10-21 18:09:31 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	994797, 994798, 994799, 994800, 1007220
Bug Blocks:	994324

Description Arun Babu Neelicattu 2013-08-07 04:00:06 UTC

A denial of service (DoS) flaw has been indentified in the implementation of org.jboss.remoting.transport.socket.ServerThread class within the JBoss Remoting component. This flaw allows an unauthenticated attacker exhaust open file descriptors available to a server. Note that to exploit this flaw as a remote attacker, it is required that the remoting port should be exposed either directly or indirectly.

Comment 2 David Jorm 2013-08-07 05:28:53 UTC

Acknowledgements: 

This issue was discovered by James Livingston of Red Hat Support Engineering Group.

Comment 4 errata-xmlrpc 2013-09-30 17:54:01 UTC

This issue has been addressed in following products:

  Red Hat JBoss BRMS 5.3.1

Via RHSA-2013:1373 https://rhn.redhat.com/errata/RHSA-2013-1373.html

Comment 5 errata-xmlrpc 2013-09-30 17:54:35 UTC

This issue has been addressed in following products:

  Red Hat JBoss Web Platform 5.2.0

Via RHSA-2013:1372 https://rhn.redhat.com/errata/RHSA-2013-1372.html

Comment 6 errata-xmlrpc 2013-09-30 17:55:36 UTC

This issue has been addressed in following products:

  Red Hat JBoss Enterprise Application Platform 5.2.0

Via RHSA-2013:1371 https://rhn.redhat.com/errata/RHSA-2013-1371.html

Comment 7 errata-xmlrpc 2013-09-30 17:57:56 UTC

This issue has been addressed in following products:

  JBEWP 5 for RHEL 4
  JBEWP 5 for RHEL 5
  JBEWP 5 for RHEL 6

Via RHSA-2013:1370 https://rhn.redhat.com/errata/RHSA-2013-1370.html

Comment 8 errata-xmlrpc 2013-09-30 17:58:05 UTC

This issue has been addressed in following products:

  JBEAP 5 for RHEL 4
  JBEAP 5 for RHEL 5
  JBEAP 5 for RHEL 6

Via RHSA-2013:1369 https://rhn.redhat.com/errata/RHSA-2013-1369.html

Comment 9 errata-xmlrpc 2013-09-30 18:00:17 UTC

This issue has been addressed in following products:

  Red Hat JBoss SOA Platform 5.3.1

Via RHSA-2013:1374 https://rhn.redhat.com/errata/RHSA-2013-1374.html

Comment 10 errata-xmlrpc 2013-10-21 17:29:21 UTC

This issue has been addressed in following products:

  Red Hat JBoss Operations Network 3.1.2

Via RHSA-2013:1448 https://rhn.redhat.com/errata/RHSA-2013-1448.html

Comment 11 errata-xmlrpc 2019-01-16 15:29:08 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2013:1371 https://access.redhat.com/errata/RHSA-2013:1371