CVE:CVE-2010-3862
CNNVD:CNNVD-201012-366
Red Hat JBoss Enterprise Application Platform（EAP）是美国红帽（Red Hat）公司的一套开源、基于J2EE的中间件平台。该平台主要用于构建、部署和托管Java应用程序与服务。
Red Hat JBoss Enterprise Application Platform(又名JBoss EAP或者JBEAP)4.3至4.3.0.CP09版本，以及5.1.0版本，以及JBoss Enterprise Web Platform(又名JBEWP)5.1.0版本中的Boss Remoting 2.2.3.SP4之前的2.2.x版本以及2.5.3.SP2之前的2.5.x版本中的org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run方法中存在输入验证漏洞。远程攻击者可以通过建立bisocket控制连接TCP会话，并不立即发送任意应用程序数据，导致拒绝服务(守护进程崩溃)。
solution:Upgrade redhat jboss_remoting to a higher version than 2.2.0,2.2.2:sp10,2.2.2:sp11,2.2.2:sp2,2.2.2:sp4,2.2.2:sp7,2.2.2:sp8,2.2.3,2.2.3:sp1,2.2.3:sp2,2.2.3:sp3,and avoid the version 2.2.0,2.2.2:sp10,2.2.2:sp11,2.2.2:sp2,2.2.2:sp4,2.2.2:sp7,2.2.2:sp8,2.2.3,2.2.3:sp1,2.2.3:sp2,2.2.3:sp3; Upgrade redhat jboss_enterprise_application_platform to a higher version than 4.3.0,4.3.0:cp01,4.3.0:cp02,4.3.0:cp03,4.3.0:cp04,4.3.0:cp05,4.3.0:cp06,4.3.0:cp07,4.3.0:cp08,4.3.0:cp09,5.1.0,and avoid the version 4.3.0,4.3.0:cp01,4.3.0:cp02,4.3.0:cp03,4.3.0:cp04,4.3.0:cp05,4.3.0:cp06,4.3.0:cp07,4.3.0:cp08,4.3.0:cp09,5.1.0; Upgrade redhat jboss_enterprise_web_platform to a higher version than 5.1.0,and avoid the version 5.1.0