Our IT department has instructed us to remove the "jmx-console.war" from the JBoss container to avoid the worm.
We have performed this action on the Portal and verified that it continues to be functional to the end user.
Original News Item:
A worm has been reported as infecting unpatched JBoss 4 application servers. The worm exploits and older configuration in JBoss, which only enabled authentication on GET and POST requests. The vulnerability makes it possible to use other methods to execute arbitrary code on the server without authentication. The problem was fixed last year, but there are apparently still a number of vulnerable installs out there.
The version of JBoss installed by the caGrid Installer suffers from this vulnerability.
If you do run JBoss, please make sure to read the instructions posted by RedHat here:
Analysis of the worm:
caGrid KC Operations Manager