CVE-2005-4709: Medium severity JBoss Enterprise Java Beans vulnerability

Published Dec 31, 2005

Updated

The popSubjectContext method in the SecurityAssociation class in JBoss Enterprise Java Beans (EJB) 3.0 RC3 maintains the threadPrincipal and threadCredential values from a previous client's authentication after termination of a client session, which allows remote attackers to gain the roles of an arbitrary previous client who had the same JBoss server thread.

Affected Software

2 affected components

JBoss Enterprise Java Beans=3.0_rc3

Remediation

Patch Available

http://jira.jboss.com/jira/browse/EJBTHREE-384

Event History

Dec 31, 2005

CVE Published

05:00 AM

Feb 2, 2006

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2005-4709?

CVE-2005-4709 is considered a high-severity vulnerability due to its potential for unauthorized role escalation.

How do I fix CVE-2005-4709?

To resolve CVE-2005-4709, upgrade to a patched version of JBoss Enterprise Java Beans that addresses this authentication issue.

What systems are affected by CVE-2005-4709?

CVE-2005-4709 specifically affects JBoss Enterprise Java Beans version 3.0 RC3.

What can attackers achieve through CVE-2005-4709?

Attackers can exploit CVE-2005-4709 to gain roles and privileges from previously authenticated clients after session termination.

When was CVE-2005-4709 reported?

CVE-2005-4709 was reported in 2005, highlighting vulnerabilities present in the JBoss EJB 3.0 RC3 release.