Bug 783898 - (CVE-2012-0079) CVE-2012-0079 OpenSSO: Unspecified vulnerability allows remote attackers to affect integrity via unknown vectors
CVE-2012-0079 OpenSSO: Unspecified vulnerability allows remote attackers to a...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20120118,reported=2...
: Security
Depends On:
Blocks: 783903 784321 787847 797585
  Show dependency treegraph
 
Reported: 2012-01-23 02:19 EST by Jan Lieskovsky
Modified: 2012-08-01 06:55 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-01-26 22:04:14 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2012-01-23 02:19:37 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-0079 to the following vulnerability:

Unspecified vulnerability in Oracle OpenSSO 7.1 and 8.0 allows remote attackers to affect integrity via unknown vectors related to Administration.

References:
[1] http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0079
Comment 1 David Jorm 2012-01-26 22:04:14 EST
Statement:

Oracle OpenSSO is provided as part of the opensso quickstart example application shipped with JBoss Enterprise SOA Platform 5. The CVE-2011-3506, CVE-2011-3517, and CVE-2012-0079 flaws are not exposed unless the opensso quickstart example application is deployed, or you have created and deployed a custom application that is packaged with a copy of Oracle OpenSSO as provided by the opensso quickstart.

The opensso quickstart has been removed in JBoss Enterprise SOA Platform 5.3.0  to address these flaws. Users interested in continuing to receive updates for their custom applications using Oracle OpenSSO are advised to contact Oracle as Red Hat is no longer supporting OpenSSO.
Comment 2 Julian Coleman 2012-02-21 11:18:05 EST
Oracle has released OpenSSO 8 update 2, but this is only available to Oracle subscribers:

  http://wesunsolve.net/patch/id/141655-08
Comment 4 errata-xmlrpc 2012-07-31 10:33:45 EDT
This issue has been addressed in following products:

  JBoss Enterprise SOA Platform 5.3.0

Via RHSA-2012:1125 https://rhn.redhat.com/errata/RHSA-2012-1125.html

Note You need to log in before you can comment on or make changes to this bug.