PT-2014-5342 · Red Hat · Red Hat Jbossws

Published 2014-08-19 · Updated 2017-08-29 · CVE-2014-3464

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Red Hat JBossWS versions 6.2.0 through 6.3.0

Description The EJB invocation handler implementation in Red Hat JBossWS does not properly enforce method level restrictions for outbound messages. This allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class.

Recommendations For versions 6.2.0 through 6.3.0, consider restricting access to the EJB class to minimize the risk of exploitation until a proper fix is applied.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-3464

RHSA-2014:1019

RHSA-2014:1020

Affected Products

Red Hat Jbossws

References · 7

• http://rhn.redhat.com/errata/RHSA-2014-1020.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1021.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3464 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-1019.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95409 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3464 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1102317 · Note