PT-2013-1816 · Red Hat · Red Hat Jboss Enterprise Application Platform+1

David Jorm · Published 2013-03-12 · Updated 2023-02-13 · CVE-2012-5629

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform (EAP) versions 4.3.0 CP10 through 6.0.1 JBoss Enterprise Web Platform (EWP) version 5.2.0

Description The default configuration of the LdapLoginModule and LdapExtLoginModule modules allows remote attackers to bypass authentication via an empty password.

Recommendations For JBoss Enterprise Application Platform (EAP) versions 4.3.0 CP10 through 6.0.1, update the configuration to disallow empty passwords. For JBoss Enterprise Web Platform (EWP) version 5.2.0, update the configuration to disallow empty passwords. As a temporary workaround, consider disabling the LdapLoginModule and LdapExtLoginModule modules until a proper configuration update can be applied.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-5629

RHSA-2013:0229

RHSA-2013:0230

RHSA-2013:0231

RHSA-2013:0249

Affected Products

Red Hat Jboss Enterprise Application Platform

Jboss Enterprise Web Platform

References · 12

• http://rhn.redhat.com/errata/RHSA-2013-0586.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0533.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0234.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0248.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0232.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0230.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0229.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0231.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0233.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5629 · Security Note
• http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=885569 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5629 · Note