PT-2010-1651 · Red Hat+1 · Jboss+1

Published 2010-05-07 · Updated 2018-10-10 · CVE-2009-4843

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ToutVirtual VirtualIQ Pro versions prior to 3.5 build 8691

Description The issue allows remote attackers to execute arbitrary commands due to the lack of administrative authentication for JBoss console access. This can be achieved via requests to the JMX Management Console or the Web Console.

Recommendations For versions prior to 3.5 build 8691, update to version 3.5 build 8691 or later to ensure administrative authentication is required for JBoss console access.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-4843

Affected Products

Jboss

Virtualiq Pro

References · 4

• 🔥 http://securenetwork.it/ricerca/advisory/download/SN-2009-02.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4843 · Security Note
• http://secunia.com/advisories/37297 · Vendor Advisory
• http://securityfocus.com/archive/1/507729/100/0/threaded · Note