Bug 783898 (CVE-2012-0079) - CVE-2012-0079 OpenSSO: Unspecified vulnerability allows remote attackers to affect integrity via unknown vectors
Summary: CVE-2012-0079 OpenSSO: Unspecified vulnerability allows remote attackers to a...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-0079
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 783903 784321 787847 797585
TreeView+ depends on / blocked
 
Reported: 2012-01-23 07:19 UTC by Jan Lieskovsky
Modified: 2021-02-24 13:18 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2012-01-27 03:04:14 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:1125 0 normal SHIPPED_LIVE Important: JBoss Enterprise SOA Platform 5.3.0 update 2012-07-31 18:32:35 UTC

Description Jan Lieskovsky 2012-01-23 07:19:37 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-0079 to the following vulnerability:

Unspecified vulnerability in Oracle OpenSSO 7.1 and 8.0 allows remote attackers to affect integrity via unknown vectors related to Administration.

References:
[1] http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0079
Comment 1 David Jorm 2012-01-27 03:04:14 UTC 
Statement:

Oracle OpenSSO is provided as part of the opensso quickstart example application shipped with JBoss Enterprise SOA Platform 5. The CVE-2011-3506, CVE-2011-3517, and CVE-2012-0079 flaws are not exposed unless the opensso quickstart example application is deployed, or you have created and deployed a custom application that is packaged with a copy of Oracle OpenSSO as provided by the opensso quickstart.

The opensso quickstart has been removed in JBoss Enterprise SOA Platform 5.3.0  to address these flaws. Users interested in continuing to receive updates for their custom applications using Oracle OpenSSO are advised to contact Oracle as Red Hat is no longer supporting OpenSSO.
Comment 2 Julian Coleman 2012-02-21 16:18:05 UTC 
Oracle has released OpenSSO 8 update 2, but this is only available to Oracle subscribers:

  http://wesunsolve.net/patch/id/141655-08
Comment 4 errata-xmlrpc 2012-07-31 14:33:45 UTC 
This issue has been addressed in following products:

  JBoss Enterprise SOA Platform 5.3.0

Via RHSA-2012:1125 https://rhn.redhat.com/errata/RHSA-2012-1125.html
Note You need to log in before you can comment on or make changes to this bug.