PT-2018-5380 · Red Hat · Red Hat Jboss Enterprise Application Platform

Publicado 2018-01-10 · Atualizado 2019-10-09 · CVE-2017-12189

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform version 7.0.7.GA

Description The issue is related to unsafe file handling in the jboss init script, which could lead to local privilege escalation. This problem arose from an incomplete fix for a previous issue.

Recommendations For Red Hat JBoss Enterprise Application Platform version 7.0.7.GA, consider restricting access to the jboss init script to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

LPE

Enumeração de Fraquezas

CWE-282

Identificadores relacionados

CVE-2017-12189

RHSA-2018:0002

RHSA-2018:0004

RHSA-2018:0005

Produtos afetados

Red Hat Jboss Enterprise Application Platform

Referências · 8

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12189 · Nota
• https://osv.dev/vulnerability/CVE-2017-12189 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:0003 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:0004 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:0002 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12189 · Nota de Segurança
• http://securityfocus.com/bid/102407 · Nota
• https://access.redhat.com/errata/RHSA-2018:0005 · Aviso do Fabricante