PT-2013-1483 · Red Hat · Brms Platform+2

David Jorm · Published 2013-02-05 · Updated 2015-01-18 · CVE-2012-0034

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform (EAP) versions 5.1.2 through 5.2.0 Web Platform (EWP) versions 5.1.2 through 5.2.0 BRMS Platform versions prior to 5.3.1

Description The issue allows local users to obtain sensitive information, specifically usernames and passwords, by reading the log file when an exception is thrown. This occurs because the NonManagedConnectionFactory logs the username and password in cleartext.

Recommendations For JBoss Enterprise Application Platform (EAP) versions 5.1.2 through 5.2.0, consider updating to a version that does not log sensitive information in cleartext. For Web Platform (EWP) versions 5.1.2 through 5.2.0, consider updating to a version that does not log sensitive information in cleartext. For BRMS Platform versions prior to 5.3.1, update to version 5.3.1 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2012-0034

RHSA-2013:0191

RHSA-2013:0192

RHSA-2013:0193

RHSA-2013:0195

RHSA-2013:0196

RHSA-2013:0197

Affected Products

Brms Platform

Red Hat Jboss Enterprise Application Platform

Web Platform

References · 18

• http://secunia.com/advisories/51984 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0533.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0196.html · Vendor Advisory
• http://secunia.com/advisories/52054 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0197.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1072.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0193.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0191.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0221.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0108.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0034 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-0195.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0192.html · Vendor Advisory
• https://issues.jboss.org/browse/JBCACHE-1612 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0034 · Note