PT-2014-2269 · Red Hat · Red Hat Jboss Enterprise Application Platform

Aleksandar Kostadinov · Publicado 2014-02-02 · Atualizado 2017-08-29 · CVE-2012-3427

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform (EAP) version 5.1.2

Description The issue allows local users to read sensitive information, including Amazon Web Services (AWS) credentials, by accessing files in the /var/cache/jboss-ec2-eap/ directory due to the use of 755 permissions.

Recommendations For JBoss Enterprise Application Platform (EAP) version 5.1.2, consider changing the permissions of the /var/cache/jboss-ec2-eap/ directory to prevent local users from reading sensitive information.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-3427

RHSA-2012:1376

Produtos afetados

Red Hat Jboss Enterprise Application Platform

Referências · 7

• http://osvdb.org/86409 · Nota
• http://securityfocus.com/bid/55945 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3427 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-3427 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79398 · Nota
• http://rhn.redhat.com/errata/RHSA-2012-1376.html · Aviso do Fabricante
• http://secunia.com/advisories/51016 · Aviso do Fabricante