what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2014-0887-02

Red Hat Security Advisory 2014-0887-02
Posted Jul 16, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0887-02 - JBoss Remoting is a stand-alone project that provides an API for making remote invocations using pluggable transports and data marshallers. JBoss Application Server 5 and supported Red Hat JBoss 5.x products contain JBoss Remoting, which includes a partial implementation of the JMX remoting specification JSR 160. This implementation is provided in jmx-remoting.sar, which is deployed by default in unsupported community releases of JBoss Application Server 5.x. This implementation does not implement security as defined in JSR 160, and therefore does not apply any authentication or authorization constraints. A remote attacker could use this flaw to potentially execute arbitrary code on a vulnerable server. All of the supported Red Hat JBoss 5.x products are not affected by this issue in their default configuration. These products are only vulnerable if JMX remoting is enabled by manually deploying jmx-remoting.sar from the jboss-as/docs/examples directory. Unsupported community releases of JBoss Application Server 5.x are affected. All users of the standalone JBoss Remoting project are also affected.

tags | advisory, remote, arbitrary
systems | linux, redhat
advisories | CVE-2014-3518
SHA-256 | 135d5c4a321a8fbc578a3508486fc58852de448195dd8f13ec7114baf60130ff

Red Hat Security Advisory 2014-0887-02

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Important: JBoss Remoting security update
Advisory ID: RHSA-2014:0887-02
Product: Red Hat JBoss Middleware
Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0887.html
Issue date: 2014-07-16
CVE Names: CVE-2014-3518
=====================================================================

1. Summary:

This advisory contains instructions on how to resolve one security issue
found in the JBoss Remoting component, which is included in Red Hat JBoss
Enterprise Application Platform 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat
JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1.

The Red Hat Security Response Team has rated this security issue as having
Important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

2. Description:

JBoss Remoting is a stand-alone project that provides an API for making
remote invocations using pluggable transports and data marshallers.

JBoss Application Server 5 and supported Red Hat JBoss 5.x products contain
JBoss Remoting, which includes a partial implementation of the JMX remoting
specification JSR 160. This implementation is provided in jmx-remoting.sar,
which is deployed by default in unsupported community releases of JBoss
Application Server 5.x. This implementation does not implement security as
defined in JSR 160, and therefore does not apply any authentication or
authorization constraints. A remote attacker could use this flaw to
potentially execute arbitrary code on a vulnerable server. All of the
supported Red Hat JBoss 5.x products are not affected by this issue in
their default configuration. These products are only vulnerable if JMX
remoting is enabled by manually deploying jmx-remoting.sar from the
jboss-as/docs/examples directory. Unsupported community releases of JBoss
Application Server 5.x are affected. All users of the standalone JBoss
Remoting project are also affected. (CVE-2014-3518)

Red Hat would like to thank Harun ESUR of Sceptive for reporting this
issue.

All users of Red Hat JBoss Enterprise Application Platform 5.2.0, Red Hat
JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss
SOA Platform 5.3.1 as provided from the Red Hat Customer Portal who have
jmx-remoting.sar deployed are advised to follow the instructions provided
in the Solution section of this advisory.

3. Solution:

In case your server is affected, undeploy jmx-remoting.sar if JMX remoting
is not required by your applications. If your applications do require it,
secure JMX remoting by following the instructions at
https://access.redhat.com/solutions/238943

For more information, see https://access.redhat.com/solutions/1120423

4. Bugs fixed (https://bugzilla.redhat.com/):

1112545 - CVE-2014-3518 JBoss EAP/AS 5: Remote code execution via unauthenticated JMX/RMI connector

5. References:

https://www.redhat.com/security/data/cve/CVE-2014-3518.html
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/solutions/238943
https://access.redhat.com/solutions/1120423

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2014 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFTxgt5XlSAg2UNWIIRAjczAJ9F6uSgwR0JTGCNVMIDeNh/k5NFLwCfeUIh
dltY2MVzLihWQlMsE8u7jbA=
=f1Ak
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close