PT-2012-3104 · Red Hat · Jbosswebrealm+5

Arun Babu Neelicattu · Published 2012-11-23 · Updated 2017-08-29 · CVE-2012-1167

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:N/AC:H/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform versions 5.1.x through 5.1.1 JBoss Enterprise Application Platform versions 5.2.x through 5.2.1 Web Platform versions 5.1.x through 5.1.1 BRMS Platform versions prior to 5.3.0 SOA Platform versions prior to 5.3.0

Description The issue arises when the JBoss Server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm. This configuration leads to improper checking of permissions created by the WebPermissionMapping class. As a result, remote authenticated users can access arbitrary applications.

Recommendations For JBoss Enterprise Application Platform versions 5.1.x through 5.1.1, update to version 5.1.2 or later. For JBoss Enterprise Application Platform versions 5.2.x through 5.2.1, update to version 5.2.2 or later. For Web Platform versions 5.1.x through 5.1.1, update to version 5.1.2 or later. For BRMS Platform versions prior to 5.3.0, update to version 5.3.0 or later. For SOA Platform versions prior to 5.3.0, update to version 5.3.0 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-1167

RHSA-2012:1026

RHSA-2012:1027

Affected Products

Brms Platform

Red Hat Jboss Enterprise Application Platform

Jboss Server

Jbosswebrealm

Soa Platform

Web Platform

References · 16

• http://rhn.redhat.com/errata/RHSA-2012-1026.html · Vendor Advisory
• http://secunia.com/advisories/49635 · Vendor Advisory
• http://secunia.com/advisories/49658 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1232.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1125.html · Vendor Advisory
• http://secunia.com/advisories/50549 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1013.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1167 · Security Note
• http://rhn.redhat.com/errata/RHSA-2012-1014.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1027.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1028.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76680 · Note
• http://securityfocus.com/bid/54089 · Note
• http://securitytracker.com/id?1027501 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1167 · Note