PT-2009-2742 · Red Hat · Jbossws+1

Marc Schoenefeld · Published 2009-03-09 · Updated 2009-03-21 · CVE-2009-0027

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform versions 4.2.0 through 4.2.0.CP05 JBoss Enterprise Application Platform versions 4.3.0 through 4.3.0.CP03

Description The issue arises from the request handler in JBossWS not properly validating the resource path during a request for a WSDL file with a custom web-service endpoint. This allows remote attackers to read arbitrary XML files via a crafted request.

Recommendations For JBoss Enterprise Application Platform versions 4.2.0 through 4.2.0.CP05, update to version 4.2.0.CP06 or later. For JBoss Enterprise Application Platform versions 4.3.0 through 4.3.0.CP03, update to version 4.3.0.CP04 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-0027

RHSA-2009:0346

RHSA-2009:0347

RHSA-2009:0348

RHSA-2009:0349

Affected Products

Red Hat Jboss Enterprise Application Platform

Jbossws

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2009-0027 · Security Note
• http://rhn.redhat.com/errata/RHSA-2009-0348.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2009-0349.html · Vendor Advisory
• http://securitytracker.com/id?1021817 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0027 · Note
• https://jira.jboss.org/jira/browse/JBPAPP-1548 · Note
• http://rhn.redhat.com/errata/RHSA-2009-0347.html · Patch, Vendor Advisory
• http://securityfocus.com/bid/34023 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=479668 · Note
• http://secunia.com/advisories/34112 · Note
• http://rhn.redhat.com/errata/RHSA-2009-0346.html · Patch, Vendor Advisory