CVE-2003-0845: SQL Injection
First published: Thu Oct 09 2003(Updated: )
Unknown vulnerability in the HSQLDB component in JBoss 3.2.1 and 3.0.8 on Java 1.4.x platforms, when running in the default configuration, allows remote attackers to conduct unauthorized activities and possibly execute arbitrary code via certain SQL statements to (1) TCP port 1701 in JBoss 3.2.1, and (2) port 1476 in JBoss 3.0.8.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| JBoss Application Server | =3.2.1 | |
| JBoss Application Server | =3.0.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/8773
- http://sourceforge.net/docman/display_doc.php?docid=19314&group_id=22866
- http://www.redhat.com/support/errata/RHSA-2007-1048.html
- http://secunia.com/advisories/27914
- http://marc.info/?l=bugtraq&m=106547728803252&w=2
- http://marc.info/?l=bugtraq&m=106546044416498&w=2
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11300
Frequently Asked Questions
What is the severity of CVE-2003-0845?
CVE-2003-0845 is considered a critical vulnerability that can allow remote attackers to execute arbitrary code.
How do I fix CVE-2003-0845?
To fix CVE-2003-0845, update JBoss to a version that is not affected or reconfigure the system to limit access to the impacted TCP port.
What versions of JBoss are affected by CVE-2003-0845?
CVE-2003-0845 affects JBoss versions 3.2.1 and 3.0.8 running on Java 1.4.x platforms.
What attacks can be performed using CVE-2003-0845?
Attackers can conduct unauthorized activities and possibly execute arbitrary code through specific SQL statements.
Is CVE-2003-0845 a known issue in previous JBoss releases?
Yes, CVE-2003-0845 is a known vulnerability affecting older versions of JBoss when configured with default settings.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/author
- agent/references
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/jboss
- canonical/jboss application server
- version/jboss application server/3.2.1
- version/jboss application server/3.0.8