Bug 870868 – CVE-2012-4549 JBoss AS: EJB authorization succeeds for any role when allowed roles list is empty

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 870868 - (CVE-2012-4549) CVE-2012-4549 JBoss AS: EJB authorization succeeds for any role when allowed roles list is empty

Summary:	CVE-2012-4549 JBoss AS: EJB authorization succeeds for any role when allowed ...

Status:	CLOSED ERRATA

Aliases:	CVE-2012-4549

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20121218,repor...
Keywords:	Security

Depends On:
Blocks:	876438 881519
	Show dependency tree / graph

Reported:	2012-10-29 00:03 EDT by Arun Babu Neelicattu
Modified:	2015-02-15 16:51 EST (History)
CC List:	4 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2012-12-18 20:12:47 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
JBoss Issue Tracker	JBPAPP-10295	Blocker	Closed	CVE-2012-4549 - JBoss AS: EJB authorization succeeds for any role when allowed roles list is empty	2018-01-31 14:08 EST
Red Hat Product Errata	RHSA-2012:1591	normal	SHIPPED_LIVE	Important: JBoss Enterprise Application Platform 6.0.1 update	2012-12-18 22:19:29 EST
Red Hat Product Errata	RHSA-2012:1592	normal	SHIPPED_LIVE	Important: JBoss Enterprise Application Platform 6.0.1 update	2012-12-18 22:31:01 EST
Red Hat Product Errata	RHSA-2012:1594	normal	SHIPPED_LIVE	Important: JBoss Enterprise Application Platform 6.0.1 update	2012-12-18 22:52:56 EST

Groups: None (edit)

Description Arun Babu Neelicattu 2012-10-29 00:03:11 EDT

When there are no allowed roles for an EJB method invocation, the invocation should be denied for all users. The processInvocation() method in org.jboss.as.ejb3.security.AuthorizationInterceptor incorrectly authorizes all method invocations to proceed when the list of allowed roles is empty.

Comment 2 David Jorm 2012-10-29 00:13:49 EDT

Acknowledgements:

This issue was discovered by Arun Neelicattu of the Red Hat Security Response Team.

Comment 24 errata-xmlrpc 2012-12-18 17:21:55 EST

This issue has been addressed in following products:

  JBEAP 6 for RHEL 5

Via RHSA-2012:1591 https://rhn.redhat.com/errata/RHSA-2012-1591.html

Comment 25 errata-xmlrpc 2012-12-18 17:33:39 EST

This issue has been addressed in following products:

  JBEAP 6 for RHEL 6

Via RHSA-2012:1592 https://rhn.redhat.com/errata/RHSA-2012-1592.html

Comment 26 errata-xmlrpc 2012-12-18 17:53:34 EST

This issue has been addressed in following products:

  JBoss Enterprise Application Platform 6.0.1

Via RHSA-2012:1594 https://rhn.redhat.com/errata/RHSA-2012-1594.html

Comment 27 David Jorm 2013-05-20 03:49:09 EDT

Statement:

This issue did not affect JBoss Enterprise Application Platform versions 4.x and 5.x.

Note You need to log in before you can comment on or make changes to this bug.