Bug 885569 (CVE-2012-5629)

Summary:	CVE-2012-5629 JBoss: allows empty password to authenticate against LDAP
Product:	[Other] Security Response	Reporter:	David Jorm <djorm>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aneelica, asantos, ccrouch, dbosanac, dmehra, jawilson, jcacek, jlieskov, lgao, mgencur, mjc, myarboro, pcheung, pslavice, rcvalle, security-response-team, sjacobs, spinder, theute
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-03-20 16:29:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	873846, 884927, 893240, 893241, 893242, 893243, 893244, 893245, 893246, 901251, 901323, 903913, 916429, 923779
Bug Blocks:	885052, 885907, 906153

Description David Jorm 2012-12-10 05:45:45 UTC

The jboss-as-domain-management and jbosssx (now part of PicketLink) modules under default conditions allow users to authenticate with a blank password when LDAP authentication is configured and unauthenticated authentication is supported by the LDAP server. This is in violation of the recommendations of RFC 4513, which states that clients should disallow empty passwords as input to a name/password authentication interface, and not allow the input of an empty password to trigger the selection of the unauthenticated authentication mechanism.

Comment 6 errata-xmlrpc 2013-02-04 23:22:42 UTC

This issue has been addressed in following products:

  JBEWP 5 for RHEL 4
  JBEWP 5 for RHEL 5
  JBEWP 5 for RHEL 6

Via RHSA-2013:0230 https://rhn.redhat.com/errata/RHSA-2013-0230.html

Comment 7 errata-xmlrpc 2013-02-04 23:23:17 UTC

This issue has been addressed in following products:

  JBEAP 5 for RHEL 4
  JBEAP 5 for RHEL 5
  JBEAP 5 for RHEL 6

Via RHSA-2013:0229 https://rhn.redhat.com/errata/RHSA-2013-0229.html

Comment 8 errata-xmlrpc 2013-02-04 23:33:12 UTC

This issue has been addressed in following products:

  JBEAP 6 for RHEL 5
  JBEAP 6 for RHEL 6

Via RHSA-2013:0231 https://rhn.redhat.com/errata/RHSA-2013-0231.html

Comment 9 errata-xmlrpc 2013-02-04 23:44:35 UTC

This issue has been addressed in following products:

  JBoss Enterprise Application Platform 6.0.1

Via RHSA-2013:0234 https://rhn.redhat.com/errata/RHSA-2013-0234.html

Comment 10 errata-xmlrpc 2013-02-04 23:45:09 UTC

This issue has been addressed in following products:

  JBoss Enterprise Web Platform 5.2.0

Via RHSA-2013:0233 https://rhn.redhat.com/errata/RHSA-2013-0233.html

Comment 11 errata-xmlrpc 2013-02-04 23:45:42 UTC

This issue has been addressed in following products:

  JBoss Enterprise Application Platform 5.2.0

Via RHSA-2013:0232 https://rhn.redhat.com/errata/RHSA-2013-0232.html

Comment 12 errata-xmlrpc 2013-02-11 18:01:01 UTC

This issue has been addressed in following products:

  JBoss Enterprise Application Platform 4.3.0 CP10

Via RHSA-2013:0248 https://rhn.redhat.com/errata/RHSA-2013-0248.html

Comment 13 errata-xmlrpc 2013-02-11 18:13:54 UTC

This issue has been addressed in following products:

  JBEAP 4.3.0 for RHEL 4
  JBEAP 4.3.0 for RHEL 5

Via RHSA-2013:0249 https://rhn.redhat.com/errata/RHSA-2013-0249.html

Comment 14 errata-xmlrpc 2013-03-04 21:01:05 UTC

This issue has been addressed in following products:

  JBoss Enterprise BRMS Platform 5.3.1
  JBoss Enterprise Portal Platform 4.3.0 CP07
  JBoss Enterprise Portal Platform 5.2.2
  JBoss Enterprise SOA Platform 4.2.0 CP05
  JBoss Enterprise SOA Platform 4.3.0 CP05

Via RHSA-2013:0586 https://rhn.redhat.com/errata/RHSA-2013-0586.html

Comment 15 errata-xmlrpc 2013-03-20 15:59:45 UTC

This issue has been addressed in following products:

  JBoss Data Grid 6.1.0

Via RHSA-2013:0665 https://rhn.redhat.com/errata/RHSA-2013-0665.html