PT-2015-3726 · Red Hat · Wildfly+1

Publicado 2015-04-21 · Atualizado 2015-10-13 · CVE-2014-3586

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Application Platform versions prior to 6.4.0 WildFly (formerly JBoss Application Server) (affected versions not specified)

Description The issue concerns the default configuration for the Command Line Interface in the affected software, which uses weak permissions for .jboss-cli-history. This weakness allows local users to obtain sensitive information via unspecified vectors.

Recommendations For Red Hat Enterprise Application Platform versions prior to 6.4.0, update to version 6.4.0 or later to resolve the issue. For WildFly (formerly JBoss Application Server), at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-3586

RHSA-2015:0846

RHSA-2015:0847

RHSA-2015:0848

Produtos afetados

Red Hat Jboss Enterprise Application Platform

Wildfly

Referências · 8

• http://securitytracker.com/id/1032183 · Nota
• http://rhn.redhat.com/errata/RHSA-2015-0849.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2015-0848.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-3586 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2015-0846.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2015-0847.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1126687 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3586 · Nota