CVE-2003-0845: SQL Injection
Unknown vulnerability in the HSQLDB component in JBoss 3.2.1 and 3.0.8 on Java 1.4.x platforms, when running in the default configuration, allows remote attackers to conduct unauthorized activities and possibly execute arbitrary code via certain SQL statements to (1) TCP port 1701 in JBoss 3.2.1, and (2) port 1476 in JBoss 3.0.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Block or restrict network access to the HSQLDB/TCP ports used by the affected JBoss versions: block inbound TCP port 1701 to hosts running JBoss 3.2.1, and block inbound TCP port 1476 to hosts running JBoss 3.0.8 (implement via firewall, ACL, or network ACLs at the perimeter and internal segmentation).
- Operational
Locate and inventory all JBoss Application Server instances version 3.2.1 and 3.0.8 running on Java 1.4.x. For identified hosts, isolate them from untrusted networks (or take them offline) until a vendor-supplied fix or other remediation is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0845?
CVE-2003-0845 is considered a critical vulnerability that can allow remote attackers to execute arbitrary code.
How do I fix CVE-2003-0845?
To fix CVE-2003-0845, update JBoss to a version that is not affected or reconfigure the system to limit access to the impacted TCP port.
What versions of JBoss are affected by CVE-2003-0845?
CVE-2003-0845 affects JBoss versions 3.2.1 and 3.0.8 running on Java 1.4.x platforms.
What attacks can be performed using CVE-2003-0845?
Attackers can conduct unauthorized activities and possibly execute arbitrary code through specific SQL statements.
Is CVE-2003-0845 a known issue in previous JBoss releases?
Yes, CVE-2003-0845 is a known vulnerability affecting older versions of JBoss when configured with default settings.