May 2010 - jboss-jira - Jboss List Archives

[JBoss JIRA] Created: (JBPORTAL-2477) eXoGadgetServer/gadgets/proxy Provides Access to protected network resources

by Ian De Villiers (JIRA)

eXoGadgetServer/gadgets/proxy Provides Access to protected network resources ---------------------------------------------------------------------------- Key: JBPORTAL-2477 URL: https://jira.jboss.org/jira/browse/JBPORTAL-2477 Project: JBoss Portal Issue Type: Bug Security Level: Public (Everyone can see) Components: Portal Security Affects Versions: 3.0 Final Environment: Tested on a number of different platforms Reporter: Ian De Villiers Fix For: 3.0 Final As per e-mail originally detailing issues with GateIn3.0.0-Beta2 sent to Thomas Heute on 16th November, 2009. When gadgets are added to the dashboard, the /eXoGadgetServer/gadgets/proxy component loads resources such as images from the portal server using the url specified by the url parameter. However, no validation checking is performed on the URL field, making it possible to access resources on alternate HTTP ports or alternate servers. Numerous similar issues exist within other portal applications. BEA Weblogics (now Oracle) and Vignette Portal have also been found to be vulnerable to similar issues in the past. However, in the case of these portal systems, these requests are only allowed to be made to hosts defined within the same scope as the originating server. Additionally (although this is configurable), the majority of these portlets can only be exploited by authenticated users. In the case of GateIn Portal, an unauthenticated user can make a request to any third-party system (or port) by tampering with the url parameter. This may result in an attacker initiating attacks against third-party systems, or accessing resources which would otherwise be protected. For example, assuming the GateIn Portal is exposed to the Internet. The J2EE application server has been configured to serve portal content on port 80, and the J2EE administrative components are only available on port 8080. Inbound traffic desitned to port 8080 from the Internet is restricted by the firewall. An attacker would be able to access the J2EE administrative components by requesting the following URL: http://VulnerableHost:80/eXoGadgetServer/gadgets/proxy?url=http%3A%2F%2F1... I've been researching these specific vulnerabilities in portal environments for a while now, and have authored a toolset specifically designed at exploiting these vulnerabilities in order to gain access to protected network resources. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

1
0
0 / 0

[JBoss JIRA] Created: (EJBTHREE-2091) Singleton EJBs do not honor @LocalBinding

by Andrew Lee Rubinger (JIRA)

Singleton EJBs do not honor @LocalBinding ----------------------------------------- Key: EJBTHREE-2091 URL: https://jira.jboss.org/jira/browse/EJBTHREE-2091 Project: EJB 3.0 Issue Type: Bug Components: singleton Affects Versions: EJB3_1 1.0.7 Reporter: Andrew Lee Rubinger Assignee: jaikiran pai Given bean implementation class: @Singleton @Startup @Local(DbInitializerLocalBusiness.class) @LocalBinding(jndiBinding = DbInitializerLocalBusiness.JNDI_NAME) // JBoss-specific JNDI Binding annotation @TransactionManagement(TransactionManagementType.BEAN) // We'll use bean-managed Tx's here, because @PostConstruct is fired in a // non-transactional context anyway, and we want to have consistent // handling when we call via "refreshWithDefaultData". public class DbInitializerBean implements DbInitializerLocalBusiness Global JNDI reports: +- DbInitializer (proxy: $Proxy143 implements interface org.jboss.ejb3.examples.chxx.transactions.ejb.DbInitializerLocalBusiness) Additionally, we're missing INFO logging about where the proxies are bound. This warning is also present: 18:35:11,166 WARN [org.jboss.ejb3.session.SessionContainer] No JndiSessionRegistrarBase was found; byassing binding of Proxies to jboss.j2ee:service=EJB3,name=DbInitializerBean in Global JNDI. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

2
2
0 / 0

[JBoss JIRA] Created: (JBMESSAGING-1806) Suckerpassword should not be in clear text form

by Howard Gao (JIRA)

Suckerpassword should not be in clear text form ----------------------------------------------- Key: JBMESSAGING-1806 URL: https://jira.jboss.org/jira/browse/JBMESSAGING-1806 Project: JBoss Messaging Issue Type: Feature Request Components: JMS Clustering Affects Versions: 1.4.6.GA.SP1 Reporter: Howard Gao Assignee: Howard Gao Fix For: 1.4.0.SP3.CP11, 1.4.7.GA Sucker's password is stored in clear text so far. We need to mask it to make it harder to read for security concerns. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

1
1
0 / 0

[JBoss JIRA] Created: (JBAS-7628) CombinedVFSCache fills tmp/vfs-nested.tmp for deployments not listed in permanentRoots

by Dietmar Scheidl (JIRA)

CombinedVFSCache fills tmp/vfs-nested.tmp for deployments not listed in permanentRoots -------------------------------------------------------------------------------------- Key: JBAS-7628 URL: https://jira.jboss.org/jira/browse/JBAS-7628 Project: JBoss Application Server Issue Type: Bug Security Level: Public (Everyone can see) Components: VFS Affects Versions: JBossAS-5.1.0.GA Reporter: Dietmar Scheidl Assignee: Ales Justin Priority: Critical CombinedVFSCache starts to fill the harddisk with copies of nested libraries from ear-deployment. This happens only if the location of the deployment is not listed in permanentRoots. We encounter this behavior by using the jmx-console to deploy the ear-file. Space is stable for about 30mins. After that any request to the web application (JSF/Richfaces/Seam/EJB3/...) leads to a new copy of all nested libraries into the vfs-nested.tmp folder. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

3
4
0 / 0

[JBoss JIRA] Created: (SECURITY-511) Release PicketBox 3.0.0.Beta6

by Anil Saldhana (JIRA)

Release PicketBox 3.0.0.Beta6 ----------------------------- Key: SECURITY-511 URL: https://jira.jboss.org/jira/browse/SECURITY-511 Project: PicketBox (JBoss Security and Identity Management) Issue Type: Release Security Level: Public (Everyone can see) Components: PicketBox Reporter: Anil Saldhana Assignee: Anil Saldhana Fix For: PicketBox_v3_0_beta6 -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

1
1
0 / 0

[JBoss JIRA] Created: (JBAS-6140) org.jboss.test.web.test.JSFIntegrationUnitTestCase.testJSFIntegrated

by Shelly McGowan (JIRA)

org.jboss.test.web.test.JSFIntegrationUnitTestCase.testJSFIntegrated -------------------------------------------------------------------- Key: JBAS-6140 URL: https://jira.jboss.org/jira/browse/JBAS-6140 Project: JBoss Application Server Issue Type: Sub-task Security Level: Public (Everyone can see) Reporter: Shelly McGowan -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

3
16
0 / 0

[JBoss JIRA] Created: (JBAOP-791) AbstractAopMetaDataDeployer.undeploy() should uninstall the scoped manager bean

by Kabir Khan (JIRA)

AbstractAopMetaDataDeployer.undeploy() should uninstall the scoped manager bean ------------------------------------------------------------------------------- Key: JBAOP-791 URL: https://jira.jboss.org/jira/browse/JBAOP-791 Project: JBoss AOP Issue Type: Bug Security Level: Public (Everyone can see) Affects Versions: 2.2.1.Alpha1 Reporter: Kabir Khan Assignee: Kabir Khan Fix For: 2.2.1.GA When running AS testsuite with jboss-reflect on javassist we get errors like this on shutdown since the beans have not been undeployed and the aop classloader has been removed at this stage 16:25:01,756 WARN [StartStopLifecycleAction] Error during stop for ScopedManager_2_vfs:///Users/kabir/sourcecontrol/jbossas/KABIR_JAVASSIST_REFLECT/subversion/testsuite/output/lib/aop-scopedtest1.sar/aop-scopedtest1.aop/: java.lang.NoClassDefFoundError: Unable to find class org.jboss.aop.domain.ScopedClassLoaderDomain from org.jboss.aop.asintegration.jboss5.ScopedVFSClassLoaderDomain in pool [org.jboss.classpool.plugins.jbosscl.JBossClDelegatingClassPool@101901517 [class path: ] - dcl:BaseClassLoader@390f34cc{aop-classloader:0.0.0$MODULE} domain: [org.jboss.classpool.plugins.jbosscl.JBossClClassPoolDomain@740ba142 name:DefaultDomain]] at org.jboss.reflect.plugins.javassist.JavassistTypeInfoFactoryImpl.raiseClassNotFound(JavassistTypeInfoFactoryImpl.java:110) [jboss-reflect.jar:2.2.0-SNAPSHOT] at org.jboss.reflect.plugins.javassist.JavassistTypeInfo.getSuperclass(JavassistTypeInfo.java:236) [jboss-reflect.jar:2.2.0-SNAPSHOT] at org.jboss.joinpoint.plugins.Config.findMethodInfo(Config.java:398) [jboss-reflect.jar:2.2.0-SNAPSHOT] at org.jboss.joinpoint.plugins.Config.findMethodInfo(Config.java:366) [jboss-reflect.jar:2.2.0-SNAPSHOT] at org.jboss.kernel.plugins.config.Configurator.handleMethod(Configurator.java:606) [jboss-kernel.jar:2.2.0.Alpha10] at org.jboss.kernel.plugins.config.Configurator.findMethod(Configurator.java:563) [jboss-kernel.jar:2.2.0.Alpha10] at org.jboss.kernel.plugins.config.AbstractKernelConfigurator.ungetMethodJoinPoint(AbstractKernelConfigurator.java:153) [jboss-kernel.jar:2.2.0.Alpha10] at org.jboss.kernel.plugins.dependency.LifecycleAction.uninstallActionInternal(LifecycleAction.java:290) [jboss-kernel.jar:2.2.0.Alpha10] at org.jboss.kernel.plugins.dependency.InstallsAwareAction.uninstallAction(InstallsAwareAction.java:175) [jboss-kernel.jar:2.2.0.Alpha10] at org.jboss.kernel.plugins.dependency.InstallsAwareAction.uninstallAction(InstallsAwareAction.java:42) [jboss-kernel.jar:2.2.0.Alpha10] at org.jboss.dependency.plugins.action.SimpleControllerContextAction.simpleUninstallAction(SimpleControllerContextAction.java:79) [jboss-dependency.jar:2.2.0.Alpha10] at org.jboss.dependency.plugins.action.AccessControllerContextAction.uninstall(AccessControllerContextAction.java:131) [jboss-dependency.jar:2.2.0.Alpha10] at org.jboss.dependency.plugins.AbstractControllerContextActions.uninstall(AbstractControllerContextActions.java:58) [jboss-dependency.jar:2.2.0.Alpha10] at org.jboss.dependency.plugins.AbstractControllerContext.uninstall(AbstractControllerContext.java:385) [jboss-dependency.jar:2.2.0.Alpha10] at org.jboss.dependency.plugins.AbstractController.uninstall(AbstractController.java:2078) [jboss-dependency.jar:2.2.0.Alpha10] at org.jboss.dependency.plugins.AbstractController.uninstallContext(AbstractController.java:1624) [jboss-dependency.jar:2.2.0.Alpha10] at org.jboss.dependency.plugins.AbstractController.uninstallContext(AbstractController.java:1472) [jboss-dependency.jar:2.2.0.Alpha10] at org.jboss.dependency.plugins.AbstractController.uninstall(AbstractController.java:756) [jboss-dependency.jar:2.2.0.Alpha10] at org.jboss.dependency.plugins.AbstractController.uninstall(AbstractController.java:669) [jboss-dependency.jar:2.2.0.Alpha10] at org.jboss.dependency.plugins.AbstractController.shutdown(AbstractController.java:270) [jboss-dependency.jar:2.2.0.Alpha10] at org.jboss.bootstrap.impl.mc.server.AbstractMCServerBase.shutdownKernelAndDeployer(AbstractMCServerBase.java:210) [jboss-bootstrap-impl-mc.jar:2.1.0-SNAPSHOT] at org.jboss.bootstrap.impl.mc.server.AbstractMCServerBase.doShutdown(AbstractMCServerBase.java:168) [jboss-bootstrap-impl-mc.jar:2.1.0-SNAPSHOT] at org.jboss.bootstrap.impl.base.server.AbstractServer.shutdown(AbstractServer.java:304) [jboss-bootstrap-impl-base.jar:2.1.0-SNAPSHOT] at org.jboss.Main$ShutdownHook$1.run(Main.java:994) [run.jar:6.0.0-SNAPSHOT (Build SVNTag:JBoss_6.0.0-SNAPSHOT date: 20100513)] -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

1
1
0 / 0

[JBoss JIRA] Created: (JBBUILD-615) Please proxy Codehaus release repo after Central, in .org Nexus

by Bob McWhirter (JIRA)

Please proxy Codehaus release repo after Central, in .org Nexus --------------------------------------------------------------- Key: JBBUILD-615 URL: https://jira.jboss.org/jira/browse/JBBUILD-615 Project: JBoss Build System Issue Type: Feature Request Components: Artifact Repositories Reporter: Bob McWhirter Since Codehaus has some sync issues to Maven Central, if we could add a fall-back proxy directly to Codehaus, that'd be awesome. Maven2 repository URL is here: http://repository.codehaus.org/ -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

2
2
0 / 0

[JBoss JIRA] Created: (JBAS-7121) Upgrade to JSF 1.2_13 in AS 5.x and trunk (6.x)

by Tihomir Surdilovic (JIRA)

Upgrade to JSF 1.2_13 in AS 5.x and trunk (6.x) ------------------------------------------------ Key: JBAS-7121 URL: https://jira.jboss.org/jira/browse/JBAS-7121 Project: JBoss Application Server Issue Type: Feature Request Security Level: Public (Everyone can see) Components: JSF Affects Versions: JBossAS-5.1.0.GA Reporter: Tihomir Surdilovic Assignee: Stan Silvert Upgrade to JSF 1.2_13 in AS 5.x and trunk (6.x). -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

2
1
0 / 0

[JBoss JIRA] Created: (SECURITY-512) Maven assembly to create binary and source zips for picketbox

by Anil Saldhana (JIRA)

Maven assembly to create binary and source zips for picketbox ------------------------------------------------------------- Key: SECURITY-512 URL: https://jira.jboss.org/jira/browse/SECURITY-512 Project: PicketBox (JBoss Security and Identity Management) Issue Type: Task Security Level: Public (Everyone can see) Components: PicketBox Reporter: Anil Saldhana Assignee: Anil Saldhana Fix For: PicketBox_v3_0_beta6 -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 2 months

1
1
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira May 2010