Bug 842477 – CVE-2009-5066 JBoss: twiddle.sh accepts credentials as command line arguments, exposing them to other local users via a process listing

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 842477 - (CVE-2009-5066) CVE-2009-5066 JBoss: twiddle.sh accepts credentials as command line arguments, exposing them to other local users via a process listing

Summary:	CVE-2009-5066 JBoss: twiddle.sh accepts credentials as command line arguments...

Status:	CLOSED ERRATA

Aliases:	CVE-2009-5066

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20091001,reported=2...
Keywords:	Security

Depends On:	849518 849519 849520
Blocks:	789173 835396 842479 849517 883225
	Show dependency tree / graph

Reported:	2012-07-23 20:58 EDT by David Jorm
Modified:	2014-10-20 20:03 EDT (History)
CC List:	3 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2013-06-02 20:25:43 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2013:0191	normal	SHIPPED_LIVE	Important: JBoss Enterprise Application Platform 5.2.0 update	2013-01-24 18:30:08 EST
Red Hat Product Errata	RHSA-2013:0192	normal	SHIPPED_LIVE	Important: JBoss Enterprise Application Platform 5.2.0 update	2013-01-24 18:28:23 EST
Red Hat Product Errata	RHSA-2013:0193	normal	SHIPPED_LIVE	Important: JBoss Enterprise Application Platform 5.2.0 update	2013-01-24 18:42:29 EST
Red Hat Product Errata	RHSA-2013:0194	normal	SHIPPED_LIVE	Important: JBoss Enterprise Application Platform 5.2.0 update	2013-01-24 18:08:14 EST
Red Hat Product Errata	RHSA-2013:0195	normal	SHIPPED_LIVE	Important: JBoss Enterprise Web Platform 5.2.0 update	2013-01-24 18:41:24 EST
Red Hat Product Errata	RHSA-2013:0196	normal	SHIPPED_LIVE	Important: JBoss Enterprise Web Platform 5.2.0 update	2013-01-24 18:55:46 EST
Red Hat Product Errata	RHSA-2013:0197	normal	SHIPPED_LIVE	Important: JBoss Enterprise Web Platform 5.2.0 update	2013-01-24 18:54:22 EST
Red Hat Product Errata	RHSA-2013:0198	normal	SHIPPED_LIVE	Important: JBoss Enterprise Web Platform 5.2.0 update	2013-01-24 19:07:17 EST
Red Hat Product Errata	RHSA-2013:0221	normal	SHIPPED_LIVE	Important: JBoss Enterprise BRMS Platform 5.3.1 update	2013-01-31 20:23:18 EST
Red Hat Product Errata	RHSA-2013:0533	normal	SHIPPED_LIVE	Important: JBoss Enterprise SOA Platform 5.3.1 update	2013-02-20 21:42:25 EST

Groups: None (edit)

Description David Jorm 2012-07-23 20:58:36 EDT

twiddle.sh accepts credentials as command line arguments. A local attacker could exploit this flaw by reading the credentials from a process listing.

Comment 4 errata-xmlrpc 2013-01-24 13:09:50 EST

This issue has been addressed in following products:

  JBoss Enterprise Application Platform 5.2.0

Via RHSA-2013:0194 https://rhn.redhat.com/errata/RHSA-2013-0194.html

Comment 5 errata-xmlrpc 2013-01-24 13:32:39 EST

This issue has been addressed in following products:

  JBEAP 5 for RHEL 5

Via RHSA-2013:0192 https://rhn.redhat.com/errata/RHSA-2013-0192.html

Comment 6 errata-xmlrpc 2013-01-24 13:33:26 EST

This issue has been addressed in following products:

  JBEAP 5 for RHEL 6

Via RHSA-2013:0191 https://rhn.redhat.com/errata/RHSA-2013-0191.html

Comment 7 errata-xmlrpc 2013-01-24 13:45:42 EST

This issue has been addressed in following products:

  JBEWP 5 for RHEL 6

Via RHSA-2013:0195 https://rhn.redhat.com/errata/RHSA-2013-0195.html

Comment 8 errata-xmlrpc 2013-01-24 13:46:27 EST

This issue has been addressed in following products:

  JBEAP 5 for RHEL 4

Via RHSA-2013:0193 https://rhn.redhat.com/errata/RHSA-2013-0193.html

Comment 9 errata-xmlrpc 2013-01-24 13:58:44 EST

This issue has been addressed in following products:

  JBEWP 5 for RHEL 4

Via RHSA-2013:0197 https://rhn.redhat.com/errata/RHSA-2013-0197.html

Comment 10 errata-xmlrpc 2013-01-24 13:59:34 EST

This issue has been addressed in following products:

  JBEWP 5 for RHEL 5

Via RHSA-2013:0196 https://rhn.redhat.com/errata/RHSA-2013-0196.html

Comment 11 errata-xmlrpc 2013-01-24 14:08:38 EST

This issue has been addressed in following products:

  JBoss Enterprise Web Platform 5.2.0

Via RHSA-2013:0198 https://rhn.redhat.com/errata/RHSA-2013-0198.html

Comment 12 errata-xmlrpc 2013-01-31 15:31:37 EST

This issue has been addressed in following products:

  JBoss Enterprise BRMS Platform 5.3.1

Via RHSA-2013:0221 https://rhn.redhat.com/errata/RHSA-2013-0221.html

Comment 13 errata-xmlrpc 2013-02-20 16:44:26 EST

This issue has been addressed in following products:

  JBoss Enterprise SOA Platform 5.3.1

Via RHSA-2013:0533 https://rhn.redhat.com/errata/RHSA-2013-0533.html

Note You need to log in before you can comment on or make changes to this bug.