CVE:CVE-2011-1483
CNNVD:CNNVD-201109-251
Red Hat JBoss Enterprise Application Platform（EAP）是美国红帽（Red Hat）公司的一套开源、基于J2EE的中间件平台。该平台主要用于构建、部署和托管Java应用程序与服务。
JBossWS Native中的wsf/common/DOMUtils.java文件中存在安全漏洞，该漏洞源于在实体扩展期间程序没有正确处理递归。远程攻击者可通过发送通过包含带有DOCTYPE声明和大量嵌套式实体引用的XML文档的特制请求利用该漏洞造成拒绝服务（内存和CPU耗尽）。以下产品和版本受到影响：Red Hat JBoss Enterprise Application Platform 4.2.0.CP09，4.3和5.1.1版本；JBoss Enterprise Portal Platform 4.3.CP06和5.1.1版本；JBoss Enterprise SOA Platform 4.2.CP05，4.3.CP05及5.1.0版本；JBoss Communications Platform 1.2.11和5.1.1版本；JBoss Enterprise BRMS Platform 5.1.0版本；JBoss Enterprise Web Platform 5.1.1版本。
solution:Upgrade redhat jboss_communications_platform to a higher version than 1.2.11,5.1.1,and avoid the version 1.2.11,5.1.1; Upgrade redhat jboss_enterprise_application_platform to a higher version than 4.2.0:cp09,4.3.0,5.1.1,and avoid the version 4.2.0:cp09,4.3.0,5.1.1; Upgrade redhat jboss_enterprise_brms_platform to a higher version than 5.1.0,and avoid the version 5.1.0; Upgrade redhat jboss_enterprise_portal_platform to a higher version than 4.3.0:cp06,5.1.1,and avoid the version 4.3.0:cp06,5.1.1; Upgrade redhat jboss_enterprise_soa_platform to a higher version than 4.2.0:cp05,4.3.0:cp05,5.1.0,and avoid the version 4.2.0:cp05,4.3.0:cp05,5.1.0; Upgrade redhat jboss_enterprise_web_platform to a higher version than 5.1.1,and avoid the version 5.1.1; Upgrade hp network_node_manager_i to a higher version than 9.0,9.01,9.02,9.03,9.10,and avoid the version 9.0,9.01,9.02,9.03,9.10