exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

SpringSource tc Server Unauthenticated Remote Access

SpringSource tc Server Unauthenticated Remote Access
Posted May 19, 2010
Authored by SpringSource Security Team

The SpringSource tc Server suffers from an unauthenticated remote access vulnerability in relation to the JMX interface.

tags | advisory, remote, bypass
advisories | CVE-2010-1454
SHA-256 | d8837f97c98e36f3dfe3aaa8777b942e3480fd0ee9a2827b13650cfc14baeaa2

SpringSource tc Server Unauthenticated Remote Access

Change Mirror Download
CVE-2010-1454: SpringSource tc Server unauthenticated remote access to JMX interface

Severity: Critical

Vendor:
SpringSource, a division of VMware

Versions Affected:
tc Server Runtime 6.0.19.A, 6.0.20.A, 6.0.20.B, 6.0.20.C, 6.0.25.A

Description:
A problem has been identified in the com.springsource.tcserver.serviceability.rmi.JmxSocketListener. If the listener is configured to use an encrypted password ( i.e. the password is prefaced with s2enc:// ) then entering either the correct password or an empty string will allow authenticated access to the JMX interface. The JMX interface is not remotely accessible by default but may be configured for remote access by setting the address attribute.

Mitigation:
All users are recommended to immediately switch to non-encrypted passwords for the JMX interface or to disable the JMX interface.
Users wishing to continue to use the JMX interface with encrypted passwords should upgrade the tc Server Runtime to 6.0.20.D or 6.0.25.A-SR01 (included in tc Server 2.0.0.SR01) available from the SpringSource support portal (for customers with support contracts) or the SpringSource download centre.

Credit:
This vulnerability was discovered by Erhan Baz at Yapi Kredi.

References:
[1] http://www.springsource.com/security/tc-server

Mark Thomas
SpringSource Security Team
Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close