Bug 870871 (CVE-2012-4550)

Summary:	CVE-2012-4550 JBoss JACC: Security constraints configured for EJBs are incorrectly interpreted and not applied
Product:	[Other] Security Response	Reporter:	Arun Babu Neelicattu <aneelica>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	djorm, grocha, pcheung
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-12-19 00:59:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	881519, 881537

Description Arun Babu Neelicattu 2012-10-29 04:44:51 UTC

When using role-based authorization to configure EJB access, JACC permissions should be used to determine access. The implementation logic of the JACC workflow resulted in the authorization being incorrectly configured and wrongly delegated. As a result, the configured authorization modules (JACC, XACML, etc.) are never called and the JACC permissions are never used to determine access to an EJB. This flaw only affects JBoss Enterprise Application Platform 6. Earlier versions are not affected.

Comment 2 Murray McAllister 2012-10-30 21:03:24 UTC

Acknowledgements:

This issue was discovered by Josef Cacek of the Red Hat JBoss EAP Quality Engineering team.

Comment 4 errata-xmlrpc 2012-12-18 22:21:58 UTC

This issue has been addressed in following products:

  JBEAP 6 for RHEL 5

Via RHSA-2012:1591 https://rhn.redhat.com/errata/RHSA-2012-1591.html

Comment 5 errata-xmlrpc 2012-12-18 22:33:42 UTC

This issue has been addressed in following products:

  JBEAP 6 for RHEL 6

Via RHSA-2012:1592 https://rhn.redhat.com/errata/RHSA-2012-1592.html

Comment 6 errata-xmlrpc 2012-12-18 22:53:36 UTC

This issue has been addressed in following products:

  JBoss Enterprise Application Platform 6.0.1

Via RHSA-2012:1594 https://rhn.redhat.com/errata/RHSA-2012-1594.html

Comment 7 David Jorm 2013-05-07 05:44:04 UTC

Statement:

This issue did not affect JBoss Enterprise Application Platform versions 4.x and 5.x.