Bug 1049736 – CVE-2014-0005 PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1049736 - (CVE-2014-0005) CVE-2014-0005 PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application

Summary:	CVE-2014-0005 PicketBox/JBossSX: Unauthorized access to and modification of a...

Status:	NEW

Aliases:	CVE-2014-0005

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20140331,repor...
Keywords:	Security

Depends On:	1065110 1160705 1049737 1049738 1049739 1049740 1065111 1065113 1166955 1166956 1166957
Blocks:	1049742 1082938 1181883 1182419
	Show dependency tree / graph

Reported:	2014-01-08 01:12 EST by Arun Babu Neelicattu
Modified:	2018-02-07 13:12 EST (History)
CC List:	16 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	It was identified that PicketBox/JBossSX allowed any deployed application to alter or read the underlying application server configuration and state without any authorization checks. An attacker able to deploy applications could use this flaw to circumvent security constraints applied to other applications deployed on the same system, disclose privileged information, and in certain cases allow arbitrary code execution.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2015:0234	normal	SHIPPED_LIVE	Important: Red Hat JBoss BPM Suite 6.0.3 security update	2015-02-17 22:27:47 EST
Red Hat Product Errata	RHSA-2015:0235	normal	SHIPPED_LIVE	Important: Red Hat JBoss BRMS 6.0.3 security update	2015-02-17 22:27:36 EST
Red Hat Product Errata	RHSA-2015:0720	normal	SHIPPED_LIVE	Important: Red Hat JBoss Fuse Service Works 6.0.0 security update	2015-03-24 21:05:53 EDT
Red Hat Product Errata	RHSA-2015:1009	normal	SHIPPED_LIVE	Important: Red Hat JBoss Portal 6.2.0 update	2015-05-14 15:14:47 EDT

Groups: None (edit)

Description Arun Babu Neelicattu 2014-01-08 01:12:45 EST

IssueDescription:

It was identified that PicketBox/JBossSX allowed any deployed application to alter or read the underlying application server configuration and state without any authorization checks. An attacker able to deploy applications could use this flaw to circumvent security constraints applied to other applications deployed on the same system, disclose privileged information, and in certain cases allow arbitrary code execution.

Comment 3 Martin Prpič 2014-01-08 11:16:11 EST

Acknowledgements:

This issue was discovered by Josef Cacek of the Red Hat JBoss EAP Quality Engineering team.

Comment 10 Arun Babu Neelicattu 2014-07-24 04:02:22 EDT

This issue has been addressed in following products:

  Red Hat JBoss Enterprise Application Platform 6.2.2

Via RHSA-2014:0345 https://rhn.redhat.com/errata/RHSA-2014-0345.html

Comment 11 Arun Babu Neelicattu 2014-07-24 04:02:34 EDT

This issue has been addressed in following products:

  JBEAP 6.2 for RHEL 5
  JBEAP 6 for RHEL 5

Via RHSA-2014:0343 https://rhn.redhat.com/errata/RHSA-2014-0343.html

Comment 12 Arun Babu Neelicattu 2014-07-24 04:02:46 EDT

This issue has been addressed in following products:

  JBEAP 6.2 for RHEL 6
  JBEAP 6 for RHEL 6

Via RHSA-2014:0344 https://rhn.redhat.com/errata/RHSA-2014-0344.html

Comment 15 errata-xmlrpc 2015-02-17 17:27:53 EST

This issue has been addressed in the following products:

  Red Hat JBoss BRMS 6.0.3

Via RHSA-2015:0235 https://rhn.redhat.com/errata/RHSA-2015-0235.html

Comment 16 errata-xmlrpc 2015-02-17 17:31:41 EST

This issue has been addressed in the following products:

  Red Hat JBoss BPM Suite 6.0.3

Via RHSA-2015:0234 https://rhn.redhat.com/errata/RHSA-2015-0234.html

Comment 18 errata-xmlrpc 2015-03-24 17:06:11 EDT

This issue has been addressed in the following products:

  Red Hat JBoss Fuse Service Works 6.0.0

Via RHSA-2015:0720 https://rhn.redhat.com/errata/RHSA-2015-0720.html

Comment 19 errata-xmlrpc 2015-05-14 11:15:05 EDT

This issue has been addressed in the following products:

  JBoss Portal 6.2.0

Via RHSA-2015:1009 https://rhn.redhat.com/errata/RHSA-2015-1009.html

Note You need to log in before you can comment on or make changes to this bug.