CVE-2014-3518

Related Files

Red Hat Security Advisory 2014-0887-02

Posted Jul 16, 2014

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0887-02 - JBoss Remoting is a stand-alone project that provides an API for making remote invocations using pluggable transports and data marshallers. JBoss Application Server 5 and supported Red Hat JBoss 5.x products contain JBoss Remoting, which includes a partial implementation of the JMX remoting specification JSR 160. This implementation is provided in jmx-remoting.sar, which is deployed by default in unsupported community releases of JBoss Application Server 5.x. This implementation does not implement security as defined in JSR 160, and therefore does not apply any authentication or authorization constraints. A remote attacker could use this flaw to potentially execute arbitrary code on a vulnerable server. All of the supported Red Hat JBoss 5.x products are not affected by this issue in their default configuration. These products are only vulnerable if JMX remoting is enabled by manually deploying jmx-remoting.sar from the jboss-as/docs/examples directory. Unsupported community releases of JBoss Application Server 5.x are affected. All users of the standalone JBoss Remoting project are also affected.

tags | advisory, remote, arbitrary

systems | linux, redhat

advisories | CVE-2014-3518

SHA-256 | 135d5c4a321a8fbc578a3508486fc58852de448195dd8f13ec7114baf60130ff

Download | Favorite | View