PT-2015-3933 · Red Hat+1 · Red Hat Jboss Enterprise Application Platform+2

Published 2015-02-13 · Updated 2017-09-08 · CVE-2014-7853

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform (EAP) versions prior to 6.3.3

Description The issue affects the JBoss Application Server (WildFly) JacORB subsystem, where it fails to properly assign socket-binding-ref sensitivity classification to the security-domain attribute. This allows remote authenticated users to obtain sensitive information by accessing the security-domain attribute.

Recommendations For versions prior to 6.3.3, update to version 6.3.3 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-7853

RHSA-2015:0216

RHSA-2015:0217

RHSA-2015:0218

Affected Products

Jboss Application Server

Jacorb

Red Hat Jboss Enterprise Application Platform

References · 9

• http://rhn.redhat.com/errata/RHSA-2015-0218.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0215.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-7853 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-0217.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0920.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0216.html · Vendor Advisory
• http://securitytracker.com/id/1031741 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7853 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100891 · Note