SB2014020202 - Permissions, Privileges, and Access Controls in JBoss Enterprise Application Platform

Description

This security bulletin contains information about 1 vulnerability.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2012-3427)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

EC2 Amazon Machine Image (AMI) in JBoss Enterprise Application Platform (EAP) 5.1.2 uses 755 permissions for /var/cache/jboss-ec2-eap/, which allows local users to read sensitive information such as Amazon Web Services (AWS) credentials by reading files in the directory.

Remediation

Install update from vendor's website.

References

• http://rhn.redhat.com/errata/RHSA-2012-1376.html
• http://secunia.com/advisories/51016
• http://www.osvdb.org/86409
• http://www.securityfocus.com/bid/55945
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79398