PT-2014-3434 · Red Hat · Jboss Wildfly Application Server+1

Publicado 2014-02-14 · Atualizado 2017-01-07 · CVE-2014-0018

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform (JBEAP) version 6.2.0 JBoss WildFly Application Server (affected versions not specified)

Description The issue arises when the software is run under a security manager, as it fails to properly restrict access to the Modular Service Container (MSC) service registry. This allows local users to modify the server by creating a crafted deployment.

Recommendations For Red Hat JBoss Enterprise Application Platform (JBEAP) version 6.2.0, consider restricting access to the Modular Service Container (MSC) service registry until a proper fix is available. For JBoss WildFly Application Server, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-0018

RHSA-2014:0170

RHSA-2014:0171

Produtos afetados

Jboss Wildfly Application Server

Red Hat Jboss Enterprise Application Platform

Referências · 7

• http://rhn.redhat.com/errata/RHSA-2014-0172.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2014-0170.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2014-0171.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-0018 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0018 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1052783 · Nota
• http://securityfocus.com/bid/65591 · Nota