PT-2014-5344 · Red Hat · Jboss Application Server+1

Published 2014-08-19 · Updated 2017-08-29 · CVE-2014-3472

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions JBoss Application Server versions 7 Red Hat JBoss Enterprise Application Platform version 6.3.0

Description The issue is related to the isCallerInRole function in SimpleSecurityManager, which does not properly check caller roles. This allows remote authenticated users to bypass access restrictions.

Recommendations For JBoss Application Server version 7, update the SimpleSecurityManager to properly check caller roles. For Red Hat JBoss Enterprise Application Platform version 6.3.0, consider restricting access to sensitive resources until a proper fix is applied.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-3472

RHSA-2014:1019

RHSA-2014:1020

Affected Products

Jboss Application Server

Red Hat Jboss Enterprise Application Platform

References · 9

• http://rhn.redhat.com/errata/RHSA-2014-1020.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1021.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0720.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3472 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-1019.html · Vendor Advisory
• http://securityfocus.com/bid/69094 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1103815 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3472 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95170 · Note