PT-2014-2269 · Red Hat · Red Hat Jboss Enterprise Application Platform

Aleksandar Kostadinov · Published 2014-02-02 · Updated 2017-08-29 · CVE-2012-3427

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform (EAP) version 5.1.2

Description The issue allows local users to read sensitive information, including Amazon Web Services (AWS) credentials, by accessing files in the /var/cache/jboss-ec2-eap/ directory due to the use of 755 permissions.

Recommendations For JBoss Enterprise Application Platform (EAP) version 5.1.2, consider changing the permissions of the /var/cache/jboss-ec2-eap/ directory to prevent local users from reading sensitive information.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-3427

RHSA-2012:1376

Affected Products

Red Hat Jboss Enterprise Application Platform

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2012-3427 · Security Note
• http://rhn.redhat.com/errata/RHSA-2012-1376.html · Vendor Advisory
• http://secunia.com/advisories/51016 · Vendor Advisory
• http://osvdb.org/86409 · Note
• http://securityfocus.com/bid/55945 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3427 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79398 · Note