Bug 749079 (CVE-2011-3517) - CVE-2011-3517 Oracle OpenSSO: unspecified vulnerability in the authentication component
Summary: CVE-2011-3517 Oracle OpenSSO: unspecified vulnerability in the authentication...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2011-3517
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 749080 797585
TreeView+ depends on / blocked
 
Reported: 2011-10-26 05:13 UTC by David Jorm
Modified: 2021-02-24 14:23 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2011-10-28 04:25:59 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:1125 0 normal SHIPPED_LIVE Important: JBoss Enterprise SOA Platform 5.3.0 update 2012-07-31 18:32:35 UTC

Description David Jorm 2011-10-26 05:13:12 UTC 
Oracle OpenSSO 8.0 exposes an unspecified vulnerability in the authentication component, allowing a remote attacker to perform a denial of service (CVE-2011-3517).
Comment 1 David Jorm 2011-10-26 05:27:52 UTC 
External References:

http://www.oracle.com/technetwork/topics/security/cpuoct2011-330135.html
Comment 3 David Jorm 2011-10-28 04:25:59 UTC 
Statement:

Oracle OpenSSO is provided as part of the opensso quickstart example application  shipped with JBoss Enterprise SOA Platform 5. The CVE-2011-3506, CVE-2011-3517, and CVE-2012-0079 flaws are not exposed unless the opensso quickstart example application is deployed, or you have created and deployed a custom application that is packaged with a copy of Oracle OpenSSO as provided by the opensso quickstart.

The opensso quickstart has been removed in JBoss Enterprise SOA Platform 5.3.0  to address these flaws. Users interested in continuing to receive updates for their custom applications using Oracle OpenSSO are advised to contact Oracle as Red Hat is no longer supporting OpenSSO.
Comment 5 errata-xmlrpc 2012-07-31 14:33:31 UTC 
This issue has been addressed in following products:

  JBoss Enterprise SOA Platform 5.3.0

Via RHSA-2012:1125 https://rhn.redhat.com/errata/RHSA-2012-1125.html
Note You need to log in before you can comment on or make changes to this bug.