PT-2008-4911 · Red Hat · Red Hat Jboss Enterprise Application Platform

Marc Schoenefeld · Published 2008-09-23 · Updated 2017-08-08 · CVE-2008-3519

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform (aka JBossEAP or EAP) versions 4.2 before CP04 and 4.3 before CP02

Description The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform allows remote attackers to obtain sensitive information via a download request when a production environment is enabled. This occurs because the DownloadServerClasses property is set to true by default.

Recommendations For Red Hat JBoss Enterprise Application Platform version 4.2 before CP04, update to CP04 or later to resolve the issue. For Red Hat JBoss Enterprise Application Platform version 4.3 before CP02, update to CP02 or later to resolve the issue. As a temporary workaround, consider setting the DownloadServerClasses property to false to prevent remote attackers from obtaining sensitive information.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2008-3519

RHSA-2008:0831

RHSA-2008:0832

RHSA-2008:0833

RHSA-2008:0834

Affected Products

Red Hat Jboss Enterprise Application Platform

References · 12

• http://redhat.com/support/errata/RHSA-2008-0833.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3519 · Security Note
• http://redhat.com/support/errata/RHSA-2008-0834.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0831.html · Vendor Advisory
• http://redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3.0.cp02/html-single/readme/index.html · Patch
• http://redhat.com/support/errata/RHSA-2008-0832.html · Vendor Advisory
• http://redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp04/html-single/readme/index.html · Patch
• http://securityfocus.com/bid/31300 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3519 · Note
• http://securitytracker.com/id?1020905 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45305 · Note
• http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=458823 · Note