#VU41391 Permissions, Privileges, and Access Controls in JBoss Enterprise Application Platform - CVE-2014-3464

Vulnerability identifier: #VU41391

Vulnerability risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2014-3464

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
JBoss Enterprise Application Platform
Server applications / Application servers

Vendor: Red Hat Inc.

Description

The vulnerability allows a remote #AU# to read and manipulate data.

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2133.

Mitigation
Install update from vendor's website.

Vulnerable software versions

JBoss Enterprise Application Platform: 6.2.0 - 6.3.0

---

External links
https://rhn.redhat.com/errata/RHSA-2014-1019.html
https://rhn.redhat.com/errata/RHSA-2014-1020.html
https://rhn.redhat.com/errata/RHSA-2014-1021.html
https://bugzilla.redhat.com/show_bug.cgi?id=1102317
https://exchange.xforce.ibmcloud.com/vulnerabilities/95409

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.