dcm4chee

Emory University has begun using DCM4CHEE as a core part of its Enterprise Service Bus infrastructure. Basically, we are using DCM4CHEE to trigger the production of ESB messages (XML representations of DICOM objects) to implement integrations between research systems and between our clinical PACS (GE Centricity) and research systems. Unfortunately, our security team has serious concerns about JBoss 4. We're working with them to take some steps to manage the vulnerability that concerns them, but it would be optimal if DCM4CHEE would work with a more contemporary version of JBoss. Also, Emory University is moving to IBM WebSphere over the next two years to be on the same middleware platform as Emory Healthcare. Will it be possible to deploy DCM4CHEE in other standard app servers? Our security team's concerns are below. We would appreciate your comments and thoughts. ----------------------------- JBoss 4 suffers from a vulnerability in its JMX-Console web application which allows unauthorized users to bypass controls and access the application. Part of the functionality of that application is the ability to deploy new applications, leading to code execution by an attacker. This vulnerability (CVE-2010-0738, 4/26/2010) postdates the latest release of JBoss 4 (4.2.3, 7/18/2008), so it is not possible to correct it by updating JBoss 4. -----------------------------