PT-2014-3472 · Red Hat · Jboss Richfaces

Published 2014-03-28 · Updated 2022-05-17 · CVE-2014-0086

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions JBoss RichFaces versions 4.3.4 through 4.3.5 JBoss RichFaces version 5.x

Description The issue allows remote attackers to cause a denial of service, resulting in memory consumption and out-of-memory errors. This is achieved by sending a large number of malformed atmosphere push requests. The doFilter function in webapp/PushHandlerFilter.java is the vulnerable component.

Recommendations For JBoss RichFaces versions 4.3.4 through 4.3.5, consider restricting access to the PushHandlerFilter to minimize the risk of exploitation. For JBoss RichFaces version 5.x, consider disabling the doFilter function in webapp/PushHandlerFilter.java until a patch is available. As a temporary workaround, restrict the number of atmosphere push requests to prevent memory consumption and out-of-memory errors.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-0086

GHSA-XFXV-F945-4QV6

Affected Products

Jboss Richfaces

References · 9

• 🔥 https://github.com/pslegr/core-1/commit/8131f15003f5bec73d475d2b724472e4b87d0757 · Exploit
• https://osv.dev/vulnerability/GHSA-xfxv-f945-4qv6 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0335.html · Vendor Advisory
• http://secunia.com/advisories/57053 · Vendor Advisory
• https://issues.jboss.org/browse/RF-13250 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-0086 · Security Note
• https://github.com/richfaces/richfaces · Note
• https://github.com/richfaces/richfaces/commit/807bc411fba070f78c5193cc03d54ab8aa39c36d · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1067268 · Note