Bug 749078 – CVE-2011-3506 Oracle OpenSSO: unspecified vulnerability in the authentication component

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 749078 - (CVE-2011-3506) CVE-2011-3506 Oracle OpenSSO: unspecified vulnerability in the authentication component

Summary:	CVE-2011-3506 Oracle OpenSSO: unspecified vulnerability in the authentication...

Status:	CLOSED ERRATA

Aliases:	CVE-2011-3506

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20111018,reported=2...
Keywords:	Security

Depends On:
Blocks:	749080 797585
	Show dependency tree / graph

Reported:	2011-10-26 01:06 EDT by David Jorm
Modified:	2015-08-19 05:13 EDT (History)
CC List:	3 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2011-10-28 00:25:22 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2012:1125	normal	SHIPPED_LIVE	Important: JBoss Enterprise SOA Platform 5.3.0 update	2012-07-31 14:32:35 EDT

Groups: None (edit)

Description David Jorm 2011-10-26 01:06:15 EDT

Oracle OpenSSO 7.1 and 8.0 expose an unspecified vulnerability in the authentication component, allowing attackers to manipulate certain data (CVE-2011-3506).

Comment 1 David Jorm 2011-10-26 01:28:35 EDT

External References:

http://www.oracle.com/technetwork/topics/security/cpuoct2011-330135.html

Comment 3 David Jorm 2011-10-28 00:25:22 EDT

Statement:

Oracle OpenSSO is provided as part of the opensso quickstart example application  shipped with JBoss Enterprise SOA Platform 5. The CVE-2011-3506, CVE-2011-3517, and CVE-2012-0079 flaws are not exposed unless the opensso quickstart example application is deployed, or you have created and deployed a custom application that is packaged with a copy of Oracle OpenSSO as provided by the opensso quickstart.

The opensso quickstart has been removed in JBoss Enterprise SOA Platform 5.3.0  to address these flaws. Users interested in continuing to receive updates for their custom applications using Oracle OpenSSO are advised to contact Oracle as Red Hat is no longer supporting OpenSSO.

Comment 5 errata-xmlrpc 2012-07-31 10:33:27 EDT

This issue has been addressed in following products:

  JBoss Enterprise SOA Platform 5.3.0

Via RHSA-2012:1125 https://rhn.redhat.com/errata/RHSA-2012-1125.html

Note You need to log in before you can comment on or make changes to this bug.