PT-2012-1275 · Red Hat · Jboss Eap+1

David Jorm · Published 2012-08-13 · Updated 2024-02-14 · CVE-2009-5066

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JBoss AS versions 5.0 and earlier JBoss EAP versions 5.0 and earlier

Description The issue allows local users to read credentials by listing the process and its arguments, as twiddle.sh in JBoss AS and EAP accepts credentials as command-line arguments.

Recommendations For JBoss AS versions 5.0 and earlier, consider removing or restricting access to the twiddle.sh script until a fix is available. For JBoss EAP versions 5.0 and earlier, consider removing or restricting access to the twiddle.sh script until a fix is available.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2009-5066

RHSA-2013:0191

RHSA-2013:0192

RHSA-2013:0193

RHSA-2013:0195

RHSA-2013:0196

RHSA-2013:0197

Affected Products

Jboss As

Jboss Eap

References · 18

• http://rhn.redhat.com/errata/RHSA-2013-0533.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0194.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0196.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0197.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0193.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-5066 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-0191.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0221.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0198.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0195.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0192.html · Vendor Advisory
• https://issues.jboss.org/browse/JBPAPP-3391?_sscc=t · Note
• http://secunia.com/advisories/52054 · Note
• http://openwall.com/lists/oss-security/2012/07/23/2 · Note
• http://openwall.com/lists/oss-security/2012/07/20/1 · Note