Bug 772514 (CVE-2012-0032)

Summary: CVE-2012-0032 JON CLI: world-writable root directory
Product: [Other] Security Response Reporter: David Jorm <djorm>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: loleary, mjc, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-03-20 17:34:18 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 772515, 804887    

Description David Jorm 2012-01-09 01:03:35 UTC 
After installing the remote client from JON 3.0, the extracted root directory is world readable/writeable/executable (0777). Although the child directories are not world writeable, by the parent directory being left in a world writeable state, it is possible to modify directory and file attributes on the child contents to trick the user into executing malicious scripts or code. A local attacker could use this flaw to compromise a remote JON server, using the credentials stolen from a privileged JON user who is using the remote client CLI from a system the local attacker has access to.
Comment 2 errata-xmlrpc 2012-03-20 17:09:25 UTC 
This issue has been addressed in following products:

  JBoss Operations Network 3.0.1

Via RHSA-2012:0406 https://rhn.redhat.com/errata/RHSA-2012-0406.html