PT-2007-2751 · Red Hat · Jboss Application Server

Publicado 2007-07-27 · Atualizado 2008-11-13 · CVE-2007-1354

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JBoss Application Server versions 4.0.2 through 4.0.5

Description The issue concerns the Access Control functionality in the JMX Console of JBoss Application Server. Specifically, it involves the JMXOpsAccessControlFilter, which uses a member variable to store the roles of the current user. This can lead to a race condition, allowing remote authenticated administrators to gain privileges by logging in during a session by a more privileged administrator. For example, this could result in privilege escalation from Read Mode to Write Mode.

Recommendations For JBoss Application Server versions 4.0.2 through 4.0.5, consider updating to a version released after 20070416 to resolve the issue.

Correção

Identificadores relacionados

CVE-2007-1354

Produtos afetados

Jboss Application Server

Referências · 7

• http://jira.jboss.com/jira/browse/ASPATCH-175 · Correção
• http://redhat.com/archives/jboss-watch-list/2007-April/msg00000.html · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2007-1354 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1354 · Nota
• http://rhn.redhat.com/errata/RHSA-2007-0151.html · Correção, Aviso do Fabricante
• http://osvdb.org/46765 · Nota
• http://jira.jboss.com/jira/browse/ASPATCH-172 · Correção