JBWEB-212: CVE-2011-3190 - authentication bypass and information disclosure

SHORT DESCRIPTION:         Provide fix for JBWEB-212. LONG DESCRIPTION:         Patch to fix CVE-2011-3190 - authentication bypass and information disclosure. MANUAL INSTALL INSTRUCTIONS:         Replace the existing %JBOSS_HOME%/server/%JBOSSCONF%/deploy/jbossweb.sar/jbossweb.jar with the new jbossweb.jar COMPATIBILITY:        5.1.2 SUPERSEDES:         N/A CREATOR:         Jean Frederic Clere DATE:         9-September-2011

It was found that when an AJP message with a request body was received, an unsolicited AJP message containing the first part or the entire request body was sent to the web server under certain circumstances. This injected message could be processed as a new request which would permit an attacker to gain full control over the AJP message and bypass authentication, and lead to information disclosure. With this update, such message injections no longer take place.