PT-2014-3472 · Red Hat · Jboss Richfaces

Publicado 2014-03-28 · Atualizado 2022-05-17 · CVE-2014-0086

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions JBoss RichFaces versions 4.3.4 through 4.3.5 JBoss RichFaces version 5.x

Description The issue allows remote attackers to cause a denial of service, resulting in memory consumption and out-of-memory errors. This is achieved by sending a large number of malformed atmosphere push requests. The doFilter function in webapp/PushHandlerFilter.java is the vulnerable component.

Recommendations For JBoss RichFaces versions 4.3.4 through 4.3.5, consider restricting access to the PushHandlerFilter to minimize the risk of exploitation. For JBoss RichFaces version 5.x, consider disabling the doFilter function in webapp/PushHandlerFilter.java until a patch is available. As a temporary workaround, restrict the number of atmosphere push requests to prevent memory consumption and out-of-memory errors.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-0086

GHSA-XFXV-F945-4QV6

Produtos afetados

Jboss Richfaces

Referências · 9

• 🔥 https://github.com/pslegr/core-1/commit/8131f15003f5bec73d475d2b724472e4b87d0757 · Exploit
• https://github.com/richfaces/richfaces · Nota
• https://github.com/richfaces/richfaces/commit/807bc411fba070f78c5193cc03d54ab8aa39c36d · Nota
• https://osv.dev/vulnerability/GHSA-xfxv-f945-4qv6 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2014-0335.html · Aviso do Fabricante
• http://secunia.com/advisories/57053 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1067268 · Nota
• https://issues.jboss.org/browse/RF-13250 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2014-0086 · Nota de Segurança