PT-2014-3475 · Red Hat · Red Hat Jboss Enterprise Application Platform

Published 2014-04-03 · Updated 2017-01-07 · CVE-2014-0093

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform (JBEAP) version 6.2.2

Description The issue is related to the improper application of permissions defined by a policy file when using a Java Security Manager (JSM). This causes applications to be granted the java.security.AllPermission permission, allowing remote attackers to bypass intended access restrictions.

Recommendations For Red Hat JBoss Enterprise Application Platform (JBEAP) version 6.2.2, consider updating the policy file to properly restrict permissions and ensure the Java Security Manager (JSM) is correctly configured to enforce these restrictions. As a temporary workaround, restrict access to sensitive applications and resources to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-0093

RHSA-2014:0343

RHSA-2014:0344

Affected Products

Red Hat Jboss Enterprise Application Platform

References · 7

• http://secunia.com/advisories/57675 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0343.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0093 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-0344.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0345.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0093 · Note
• http://securityfocus.com/bid/66596 · Note