PT-2014-5344 · Red Hat · Jboss Application Server+1

Publicado 2014-08-19 · Atualizado 2017-08-29 · CVE-2014-3472

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions JBoss Application Server versions 7 Red Hat JBoss Enterprise Application Platform version 6.3.0

Description The issue is related to the isCallerInRole function in SimpleSecurityManager, which does not properly check caller roles. This allows remote authenticated users to bypass access restrictions.

Recommendations For JBoss Application Server version 7, update the SimpleSecurityManager to properly check caller roles. For Red Hat JBoss Enterprise Application Platform version 6.3.0, consider restricting access to sensitive resources until a proper fix is applied.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-3472

RHSA-2014:1019

RHSA-2014:1020

Produtos afetados

Jboss Application Server

Red Hat Jboss Enterprise Application Platform

Referências · 9

• http://rhn.redhat.com/errata/RHSA-2014-1020.html · Aviso do Fabricante
• http://securityfocus.com/bid/69094 · Nota
• http://rhn.redhat.com/errata/RHSA-2014-1021.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2015-0720.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-3472 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1103815 · Nota
• http://rhn.redhat.com/errata/RHSA-2014-1019.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3472 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95170 · Nota