Bug 1380852 – CVE-2016-7061 EAP: Sensitive data can be exposed at the server level in domain mode

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1380852 - (CVE-2016-7061) CVE-2016-7061 EAP: Sensitive data can be exposed at the server level in domain mode

Summary:	CVE-2016-7061 EAP: Sensitive data can be exposed at the server level in domai...

Status:	NEW

Aliases:	CVE-2016-7061

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20161107,reported=2...
Keywords:	Security

Depends On:	1381324 1381325
Blocks:	1392081 1413131 1520314
	Show dependency tree / graph

Reported:	2016-09-30 15:10 EDT by Bharti Kundal
Modified:	2018-10-19 17:37 EDT (History)
CC List:	22 users (show)

See Also:
Fixed In Version:	eap 7.0.4
Doc Type:	If docs needed, set a value
Doc Text:	It was discovered that when configuring RBAC and marking information as sensitive, users with a Monitor role are able to view the sensitive information.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Flags:	bkundal: needinfo-

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2017:0170	normal	SHIPPED_LIVE	Moderate: JBoss Enterprise Application Platform 7.0.4 on RHEL 6	2017-01-20 15:58:37 EST
Red Hat Product Errata	RHSA-2017:0171	normal	SHIPPED_LIVE	Moderate: JBoss Enterprise Application Platform 7.0.4 for RHEL 7	2017-01-20 15:58:12 EST
Red Hat Product Errata	RHSA-2017:0172	normal	SHIPPED_LIVE	Moderate: Red Hat JBoss Enterprise Application Platform 7.0.4	2017-01-18 20:40:13 EST
Red Hat Product Errata	RHSA-2017:0173	normal	SHIPPED_LIVE	Moderate: eap7-jboss-ec2-eap security update	2017-01-20 16:06:12 EST
Red Hat Product Errata	RHSA-2017:0244	normal	SHIPPED_LIVE	Important: Red Hat JBoss Enterprise Application Platform security update	2017-02-02 20:39:38 EST
Red Hat Product Errata	RHSA-2017:0245	normal	SHIPPED_LIVE	Important: Red Hat JBoss Enterprise Application Platform security update	2017-02-02 20:36:51 EST
Red Hat Product Errata	RHSA-2017:0246	normal	SHIPPED_LIVE	Important: Red Hat JBoss Enterprise Application Platform security update	2017-02-02 20:33:58 EST
Red Hat Product Errata	RHSA-2017:0247	normal	SHIPPED_LIVE	Moderate: Red Hat JBoss Enterprise Application Platform security update	2017-05-02 21:58:19 EDT
Red Hat Product Errata	RHSA-2017:0250	normal	SHIPPED_LIVE	Important: jboss-ec2-eap security, bug fix, and enhancement update	2017-02-02 21:03:53 EST
Red Hat Product Errata	RHSA-2017:3454	normal	SHIPPED_LIVE	Important: Red Hat JBoss Enterprise Application Platform 7.1.0 security update	2017-12-13 17:48:09 EST
Red Hat Product Errata	RHSA-2017:3455	normal	SHIPPED_LIVE	Important: Red Hat JBoss Enterprise Application Platform 7.1.0 security update	2017-12-13 17:57:25 EST
Red Hat Product Errata	RHSA-2017:3456	normal	SHIPPED_LIVE	Important: Red Hat JBoss Enterprise Application Platform 7.1.0 security update	2017-12-13 17:31:03 EST
Red Hat Product Errata	RHSA-2017:3458	normal	SHIPPED_LIVE	Important: eap7-jboss-ec2-eap security update	2017-12-13 18:26:13 EST

Groups: None (edit)

Description Bharti Kundal 2016-09-30 15:10:50 EDT

Sensitive data can be exposed at the server level through CLI in domain mode

Comment 1 Bharti Kundal 2016-09-30 16:09:25 EDT

When configuring RBAC and marking information as sensitive,the users under Monitor role are able to view it.The following are the details:

<security-realms>
            <security-realm name="ManagementRealm">
                <authentication>
                   
                    <properties path="mgmt-users.properties" relative-to="jboss.domain.config.dir"/>
                </authentication>
                <authorization map-groups-to-roles="false">
                    <properties path="mgmt-groups.properties" relative-to="jboss.domain.config.dir"/>
                </authorization>                
            </security-realm>

  <management>
        <access-control provider="rbac">
            <role-mapping>
                <role name="SuperUser">
                    <include>
                        <user name="adminuser"/>
                    </include>
                </role>
                <role name="Monitor">
                    <include>
                        <user name="rbactest"/>
                   </include>
                </role>
            </role-mapping>
<constraints>
<sensitive-classifications>
<sensitive-classification type="core"
name="socket-config" requires-read="true"/>
 </sensitive-classifications>
</constraints>
</access-control>
    </management>


With user rabactest under monitor role ,the socket-bindidng read reseource fails:

[bkundal@dhcp193-167 bin]$ ./jboss-cli.sh --connect 
Authenticating against security realm: ManagementRealm
Username: rbactest
Password: 

[domain@localhost:9999 /] cd socket-binding-group=ha-sockets
[domain@localhost:9999 socket-binding-group=ha-sockets] /socket-binding-group=ha-sockets/socket-binding=http:read-resource
{
    "outcome" => "failed",
    "failure-description" => "JBAS013456: Unauthorized to execute operation 'read-resource' for resource '[
    (\"socket-binding-group\" => \"ha-sockets\"),
    (\"socket-binding\" => \"http\")
]' -- \"JBAS013475: Permission denied\"",
    "rolled-back" => true
}
[domain@localhost:9999 socket-binding-group=ha-sockets]

but this socket-config can be viewed at the server level

domain@localhost:9999 socket-binding-group=ha-sockets] cd /host=master/
[domain@localhost:9999 host=master] cd server=server-one
[domain@localhost:9999 server=server-one] cd socket-binding-group=full-sockets
[domain@localhost:9999 socket-binding-group=full-sockets] cd socket-binding=http
[domain@localhost:9999 socket-binding=http] ls -l
ATTRIBUTE         VALUE     TYPE    
bound             true      BOOLEAN 
bound-address     127.0.0.1 STRING  
bound-port        8080      INT     
client-mappings   undefined LIST    
fixed-port        false     BOOLEAN 
interface         undefined STRING  
multicast-address undefined STRING  
multicast-port    undefined INT     
name              http      STRING  
port              8080      INT     
[domain@localhost:9999 socket-binding=http]

Comment 7 errata-xmlrpc 2017-01-18 15:40:40 EST

This issue has been addressed in the following products:

  JBoss Enterprise Application Platform 7.0.4

Via RHSA-2017:0172 https://rhn.redhat.com/errata/RHSA-2017-0172.html

Comment 8 errata-xmlrpc 2017-01-18 16:54:16 EST

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7

Via RHSA-2017:0171 https://rhn.redhat.com/errata/RHSA-2017-0171.html

Comment 9 errata-xmlrpc 2017-01-18 16:54:39 EST

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6

Via RHSA-2017:0170 https://rhn.redhat.com/errata/RHSA-2017-0170.html

Comment 10 errata-xmlrpc 2017-01-18 17:12:42 EST

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6
  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7

Via RHSA-2017:0173 https://rhn.redhat.com/errata/RHSA-2017-0173.html

Comment 17 errata-xmlrpc 2017-02-02 15:23:43 EST

This issue has been addressed in the following products:



Via RHSA-2017:0247 https://rhn.redhat.com/errata/RHSA-2017-0247.html

Comment 18 errata-xmlrpc 2017-02-02 15:44:23 EST

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5

Via RHSA-2017:0246 https://rhn.redhat.com/errata/RHSA-2017-0246.html

Comment 19 errata-xmlrpc 2017-02-02 15:45:33 EST

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7

Via RHSA-2017:0245 https://rhn.redhat.com/errata/RHSA-2017-0245.html

Comment 20 errata-xmlrpc 2017-02-02 15:46:45 EST

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6

Via RHSA-2017:0244 https://rhn.redhat.com/errata/RHSA-2017-0244.html

Comment 21 errata-xmlrpc 2017-02-02 16:04:13 EST

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6

Via RHSA-2017:0250 https://rhn.redhat.com/errata/RHSA-2017-0250.html

Comment 22 errata-xmlrpc 2017-12-13 12:33:51 EST

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2017:3456 https://access.redhat.com/errata/RHSA-2017:3456

Comment 23 errata-xmlrpc 2017-12-13 13:20:20 EST

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6

Via RHSA-2017:3454 https://access.redhat.com/errata/RHSA-2017:3454

Comment 24 errata-xmlrpc 2017-12-13 13:41:44 EST

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7

Via RHSA-2017:3455 https://access.redhat.com/errata/RHSA-2017:3455

Comment 25 errata-xmlrpc 2017-12-13 13:47:41 EST

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6

Via RHSA-2017:3458 https://access.redhat.com/errata/RHSA-2017:3458

Note You need to log in before you can comment on or make changes to this bug.

bbaranow
bmaxwell
cdewolf
chazlett
csutherl
dandread
darran.lofthouse
dosoudil
ehugonne
jason.greene
jawilson
jshepherd
lgao
myarboro
pgier
psakar
pslavice
rnetuka
rsvoboda
security-response-team
twalsh
vtunka