Bug 1165522 (CVE-2014-7853)

Summary:	CVE-2014-7853 JBoss AS/WildFly JacORB Subsystem: Information disclosure via incorrect sensitivity classification of attribute
Product:	[Other] Security Response	Reporter:	Arun Babu Neelicattu <aneelica>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anmiller, asantos, bdawidow, brian.stansberry, cdewolf, chazlett, dandread, darran.lofthouse, epp-bugs, fnasser, grocha, huwang, jawilson, jdg-bugs, jpallich, jrusnack, kejohnso, lgao, mweiler, myarboro, pgier, pskopek, pslavice, rhq-maint, rsvoboda, security-response-team, spinder, theute, ttarrant, vtunka, weli
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was discovered that the JBoss Application Server (WildFly) JacORB subsystem incorrectly assigned socket-binding-ref sensitivity classification for the security-domain attribute. An authenticated user with a role that has access to attributes with socket-binding-ref and not security-domain-ref sensitivity classification could use this flaw to access sensitive information present in the security-domain attribute.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 02:36:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1165523, 1165524, 1187334
Bug Blocks:	1155350, 1164637, 1217043

Description Arun Babu Neelicattu 2014-11-19 06:06:16 UTC

It was discovered that the JBoss Application Server (WildFly) JacORB subsystem incorrectly assigned socket-binding-ref sensitivity classification for the security-domain attribute. This flaw can be used by an authenticated user with a role that have access to attributes with socket-binding-ref and not security-domain-ref sensitivity classification to access sensitive information present in the security-domain attribute.

Comment 2 Arun Babu Neelicattu 2014-11-19 06:10:34 UTC

Acknowledgements:

This issue was discovered by Darran Lofthouse of the Red Hat JBoss Enterprise Application Platform Team.

Comment 4 errata-xmlrpc 2015-02-11 20:07:14 UTC

This issue has been addressed in the following products:

  JBoss Enterprise Application Platform 6.3.3

Via RHSA-2015:0215 https://rhn.redhat.com/errata/RHSA-2015-0215.html

Comment 5 errata-xmlrpc 2015-02-11 20:26:44 UTC

This issue has been addressed in the following products:

  JBEAP 6.3.z for RHEL 6

Via RHSA-2015:0217 https://rhn.redhat.com/errata/RHSA-2015-0217.html

Comment 6 errata-xmlrpc 2015-02-11 20:30:52 UTC

This issue has been addressed in the following products:

  JBEAP 6.3.z for RHEL 5

Via RHSA-2015:0216 https://rhn.redhat.com/errata/RHSA-2015-0216.html

Comment 7 errata-xmlrpc 2015-02-11 21:14:53 UTC

This issue has been addressed in the following products:

  JBEAP 6.3.z for RHEL 7

Via RHSA-2015:0218 https://rhn.redhat.com/errata/RHSA-2015-0218.html

Comment 12 errata-xmlrpc 2015-04-30 16:10:26 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Operations Network 3.3

Via RHSA-2015:0920 https://rhn.redhat.com/errata/RHSA-2015-0920.html