CVE-2010-0738: Red Hat JBoss Authentication Bypass Vulnerability
First published: Tue Mar 16 2010(Updated: )
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp01 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp06 | |
| Redhat Jboss Enterprise Application Platform | =4.2 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp05 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp04 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp03 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp07 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp08 | |
| Redhat Jboss Enterprise Application Platform | =4.2.0-cp02 | |
| Redhat Jboss Enterprise Application Platform | =4.3.0-cp06 | |
| Redhat Jboss Enterprise Application Platform | =4.3.0-cp01 | |
| Redhat Jboss Enterprise Application Platform | =4.3.0-cp04 | |
| Redhat Jboss Enterprise Application Platform | =4.3 | |
| Redhat Jboss Enterprise Application Platform | =4.3.0-cp07 | |
| Redhat Jboss Enterprise Application Platform | =4.3.0-cp03 | |
| Redhat Jboss Enterprise Application Platform | =4.3.0-cp02 | |
| Redhat Jboss Enterprise Application Platform | =4.3.0-cp05 | |
| redhat/hibernate3 | <1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el4 |
| redhat/hibernate3-annotations | <0:3.3.1-1.12.GA_CP03.ep1.el4 | 0:3.3.1-1.12.GA_CP03.ep1.el4 |
| redhat/hsqldb | <1:1.8.0.8-3.patch03.1jpp.ep1.3.el4 | 1:1.8.0.8-3.patch03.1jpp.ep1.3.el4 |
| redhat/jacorb | <0:2.3.0-1jpp.ep1.10.el4 | 0:2.3.0-1jpp.ep1.10.el4 |
| redhat/jakarta-commons-httpclient | <1:3.0.1-1.patch01.1jpp.ep1.4.el4 | 1:3.0.1-1.patch01.1jpp.ep1.4.el4 |
| redhat/jboss-aop | <0:1.5.5-3.CP05.2.ep1.el4 | 0:1.5.5-3.CP05.2.ep1.el4 |
| redhat/jbossas | <0:4.2.0-6.GA_CP09.6.ep1.el4 | 0:4.2.0-6.GA_CP09.6.ep1.el4 |
| redhat/jboss-cache | <0:1.4.1-6.SP14.1.ep1.el4 | 0:1.4.1-6.SP14.1.ep1.el4 |
| redhat/jboss-remoting | <0:2.2.3-3.SP2.ep1.el4 | 0:2.2.3-3.SP2.ep1.el4 |
| redhat/jboss-seam | <0:1.2.1-1.ep1.24.el4 | 0:1.2.1-1.ep1.24.el4 |
| redhat/jbossts | <1:4.2.3-1.SP5_CP09.1jpp.ep1.1.el4 | 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.el4 |
| redhat/jbossweb | <0:2.0.0-6.CP13.0jpp.ep1.1.el4 | 0:2.0.0-6.CP13.0jpp.ep1.1.el4 |
| redhat/rh-eap-docs | <0:4.2.0-7.GA_CP09.ep1.5.el4 | 0:4.2.0-7.GA_CP09.ep1.5.el4 |
| redhat/hibernate3 | <1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5 | 1:3.2.4-1.SP1_CP10.0jpp.ep1.1.el5 |
| redhat/hibernate3-annotations | <0:3.3.1-1.12.GA_CP03.ep1.el5 | 0:3.3.1-1.12.GA_CP03.ep1.el5 |
| redhat/jacorb | <0:2.3.0-1jpp.ep1.10.1.el5 | 0:2.3.0-1jpp.ep1.10.1.el5 |
| redhat/jboss-aop | <0:1.5.5-3.CP05.2.ep1.1.el5 | 0:1.5.5-3.CP05.2.ep1.1.el5 |
| redhat/jbossas | <0:4.2.0-6.GA_CP09.6.ep1.el5 | 0:4.2.0-6.GA_CP09.6.ep1.el5 |
| redhat/jboss-cache | <0:1.4.1-6.SP14.1.ep1.1.el5 | 0:1.4.1-6.SP14.1.ep1.1.el5 |
| redhat/jboss-remoting | <0:2.2.3-3.SP2.ep1.1.el5 | 0:2.2.3-3.SP2.ep1.1.el5 |
| redhat/jboss-seam | <0:1.2.1-1.ep1.24.el5 | 0:1.2.1-1.ep1.24.el5 |
| redhat/jbossts | <1:4.2.3-1.SP5_CP09.1jpp.ep1.1.1.el5 | 1:4.2.3-1.SP5_CP09.1jpp.ep1.1.1.el5 |
| redhat/jbossweb | <0:2.0.0-6.CP13.0jpp.ep1.1.1.el5 | 0:2.0.0-6.CP13.0jpp.ep1.1.1.el5 |
| redhat/rh-eap-docs | <0:4.2.0-7.GA_CP09.ep1.4.1.el5 | 0:4.2.0-7.GA_CP09.ep1.4.1.el5 |
| redhat/jbossas | <0:4.3.0-7.GA_CP08.5.ep1.el4 | 0:4.3.0-7.GA_CP08.5.ep1.el4 |
| redhat/jboss-messaging | <0:1.4.0-3.SP3_CP10.2.ep1.el4 | 0:1.4.0-3.SP3_CP10.2.ep1.el4 |
| redhat/jboss-seam | <0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el4 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el4 |
| redhat/jboss-seam2 | <0:2.0.2.FP-1.ep1.23.el4 | 0:2.0.2.FP-1.ep1.23.el4 |
| redhat/jbossws | <0:2.0.1-5.SP2_CP08.1.ep1.el4 | 0:2.0.1-5.SP2_CP08.1.ep1.el4 |
| redhat/rh-eap-docs | <0:4.3.0-7.GA_CP08.ep1.6.el4 | 0:4.3.0-7.GA_CP08.ep1.6.el4 |
| redhat/jbossas | <0:4.3.0-7.GA_CP08.5.ep1.el5 | 0:4.3.0-7.GA_CP08.5.ep1.el5 |
| redhat/jboss-messaging | <0:1.4.0-3.SP3_CP10.2.ep1.el5 | 0:1.4.0-3.SP3_CP10.2.ep1.el5 |
| redhat/jboss-seam | <0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el5.1 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.20.el5.1 |
| redhat/jboss-seam2 | <0:2.0.2.FP-1.ep1.23.el5 | 0:2.0.2.FP-1.ep1.23.el5 |
| redhat/jbossws | <0:2.0.1-5.SP2_CP08.1.ep1.1.el5 | 0:2.0.1-5.SP2_CP08.1.ep1.1.el5 |
| redhat/rh-eap-docs | <0:4.3.0-7.GA_CP08.ep1.5.el5 | 0:4.3.0-7.GA_CP08.ep1.5.el5 |
| Redhat Jboss Enterprise Application Platform | =4.2.0 | |
| Redhat Jboss Enterprise Application Platform | =4.3.0 | |
| =4.2.0 | ||
| =4.3.0 | ||
| Red Hat JBoss |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://rhn.redhat.com/errata/RHSA-2010-0379.html
- https://bugzilla.redhat.com/show_bug.cgi?id=574105
- https://rhn.redhat.com/errata/RHSA-2010-0376.html
- http://www.vupen.com/english/advisories/2010/0992
- https://rhn.redhat.com/errata/RHSA-2010-0377.html
- http://securitytracker.com/id?1023918
- http://www.securityfocus.com/bid/39710
- http://secunia.com/advisories/39563
- https://rhn.redhat.com/errata/RHSA-2010-0378.html
- http://securityreason.com/securityalert/8408
- http://marc.info/?l=bugtraq&m=132129312609324&w=2
- http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=35
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58147
- https://www.cve.org/CVERecord?id=CVE-2010-0738 https://nvd.nist.gov/vuln/detail/CVE-2010-0738 https://access.redhat.com/kb/docs/DOC-30741
- https://access.redhat.com/errata/RHSA-2010:0376
- https://access.redhat.com/errata/RHSA-2010:0378
- https://access.redhat.com/errata/RHSA-2010:0377
- https://access.redhat.com/errata/RHSA-2010:0379
- https://access.redhat.com/security/cve/CVE-2010-0738
- https://access.redhat.com/kb/docs/DOC-30741
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=574105#c0
- https://community.jboss.org/wiki/SecureTheJmxConsole
- https://nvd.nist.gov/vuln/detail/CVE-2010-0738
Parent vulnerabilities
(Appears in the following advisories)
- collector/nvd-historical
- collector/nvd-index
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- agent/title
- agent/weakness
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2010-0738
- agent/author
- agent/severity
- collector/mitre-cve
- source/MITRE
- exploited/true
- ransomware/true
- collector/cisa-known-exploited
- source/CISA
- agent/references
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-cve
- agent/last-modified-date
- agent/trending
- vendor/redhat
- canonical/redhat jboss enterprise application platform
- version/redhat jboss enterprise application platform/4.2.0-cp01
- version/redhat jboss enterprise application platform/4.2.0-cp06
- version/redhat jboss enterprise application platform/4.2
- version/redhat jboss enterprise application platform/4.2.0-cp05
- version/redhat jboss enterprise application platform/4.2.0-cp04
- version/redhat jboss enterprise application platform/4.2.0-cp03
- version/redhat jboss enterprise application platform/4.2.0-cp07
- version/redhat jboss enterprise application platform/4.2.0-cp08
- version/redhat jboss enterprise application platform/4.2.0-cp02
- version/redhat jboss enterprise application platform/4.3.0-cp06
- version/redhat jboss enterprise application platform/4.3.0-cp01
- version/redhat jboss enterprise application platform/4.3.0-cp04
- version/redhat jboss enterprise application platform/4.3
- version/redhat jboss enterprise application platform/4.3.0-cp07
- version/redhat jboss enterprise application platform/4.3.0-cp03
- version/redhat jboss enterprise application platform/4.3.0-cp02
- version/redhat jboss enterprise application platform/4.3.0-cp05
- package-manager/redhat
- version/redhat jboss enterprise application platform/4.2.0
- version/redhat jboss enterprise application platform/4.3.0
- vendor/red hat
- canonical/red hat jboss