PT-2009-2742 · Red Hat · Jbossws+1

Marc Schoenefeld · Publicado 2009-03-09 · Atualizado 2009-03-21 · CVE-2009-0027

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform versions 4.2.0 through 4.2.0.CP05 JBoss Enterprise Application Platform versions 4.3.0 through 4.3.0.CP03

Description The issue arises from the request handler in JBossWS not properly validating the resource path during a request for a WSDL file with a custom web-service endpoint. This allows remote attackers to read arbitrary XML files via a crafted request.

Recommendations For JBoss Enterprise Application Platform versions 4.2.0 through 4.2.0.CP05, update to version 4.2.0.CP06 or later. For JBoss Enterprise Application Platform versions 4.3.0 through 4.3.0.CP03, update to version 4.3.0.CP04 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2009-0027

RHSA-2009:0346

RHSA-2009:0347

RHSA-2009:0348

RHSA-2009:0349

Produtos afetados

Red Hat Jboss Enterprise Application Platform

Jbossws

Referências · 11

• https://nvd.nist.gov/vuln/detail/CVE-2009-0027 · Nota de Segurança
• http://securitytracker.com/id?1021817 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0027 · Nota
• http://rhn.redhat.com/errata/RHSA-2009-0348.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2009-0349.html · Aviso do Fabricante
• https://jira.jboss.org/jira/browse/JBPAPP-1548 · Nota
• http://rhn.redhat.com/errata/RHSA-2009-0347.html · Correção, Aviso do Fabricante
• http://securityfocus.com/bid/34023 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=479668 · Nota
• http://secunia.com/advisories/34112 · Nota
• http://rhn.redhat.com/errata/RHSA-2009-0346.html · Correção, Aviso do Fabricante