Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2012-0874

Overview

Vulnerability Score 6.8 6.8
CVE Id CVE-2012-0874
Last Modified 17 Jan 2015 09:59:08
Published 05 Feb 2013 06:55:01
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact PARTIAL PARTIAL
Availability Impact PARTIAL PARTIAL
Access Vector NETWORK
Access Complexity MEDIUM
Authentication NONE

CVE-2012-0874

Summary

The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer.

Vulnerable Systems

Application

  • Redhat Jboss Enterprise Application Platform 5.2.0

  • Redhat Jboss Enterprise Brms Platform 5.3.0

  • Redhat Jboss Enterprise Web Platform 5.2.0


References

MISC - https://bugzilla.redhat.com/show_bug.cgi?id=795645

XF - jboss-eap-jmxinvokerhaservlet-code-exec(81511)

BID - 57552

SECTRACK - 1028042

SECUNIA - 52054

SECUNIA - 51984

REDHAT - RHSA-2013:0221

REDHAT - RHSA-2013:0198

REDHAT - RHSA-2013:0197

REDHAT - RHSA-2013:0196

REDHAT - RHSA-2013:0195

REDHAT - RHSA-2013:0194

REDHAT - RHSA-2013:0193

REDHAT - RHSA-2013:0192

REDHAT - RHSA-2013:0191

EXPLOIT-DB - 30211

BUGTRAQ - 20131219 ESA-2013-094: EMC Data Protection Advisor JBOSS Remote Code Execution Vulnerability

REDHAT - RHSA-2013:0533


Last Updated: 27 May 2016 11:01:48