PT-2015-3726 · Red Hat · Wildfly+1

Published 2015-04-21 · Updated 2015-10-13 · CVE-2014-3586

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Application Platform versions prior to 6.4.0 WildFly (formerly JBoss Application Server) (affected versions not specified)

Description The issue concerns the default configuration for the Command Line Interface in the affected software, which uses weak permissions for .jboss-cli-history. This weakness allows local users to obtain sensitive information via unspecified vectors.

Recommendations For Red Hat Enterprise Application Platform versions prior to 6.4.0, update to version 6.4.0 or later to resolve the issue. For WildFly (formerly JBoss Application Server), at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-3586

RHSA-2015:0846

RHSA-2015:0847

RHSA-2015:0848

Affected Products

Red Hat Jboss Enterprise Application Platform

Wildfly

References · 8

• http://rhn.redhat.com/errata/RHSA-2015-0849.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0848.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3586 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-0846.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0847.html · Vendor Advisory
• http://securitytracker.com/id/1032183 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1126687 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3586 · Note