CVE-2010-4265: Low severity red hat jboss remoting vulnerability
The JBoss EAP 430CP09 security updates for Red Hat Enterprise Linux 4, Red Hat Enterprise Linux 5 and the Customer Support Portal did not, unlike the erratum text stated, provide a fix for CVE-2010-3862, a Denial-of-Service (DoS) flaw in the jboss-remoting component. A missing patch is considered a security regression, and requires a new CVE name. This regression is assigned CVE-2010-4265. It fixes the same issue as CVE-2010-3862 and is specific to JBoss EAP 430CP09.
Other sources
The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 through 4.3.0.CP09 allows remote attackers to cause a denial of service (daemon outage) by establishing a bisocket control connection TCP session, and then not sending any application data, related to a missing CVE-2010-3862 patch. NOTE: this can be considered a duplicate of CVE-2010-3862 because a missing patch should not be assigned a separate CVE identifier.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4265?
The severity of CVE-2010-4265 is classified as moderate due to its Denial-of-Service (DoS) capabilities.
How do I fix CVE-2010-4265?
To fix CVE-2010-4265, you should apply the latest available patches from Red Hat for JBoss EAP 4.3 and affected versions.
Which versions of JBoss are affected by CVE-2010-4265?
CVE-2010-4265 affects multiple versions of JBoss Remoting and JBoss Enterprise Application Platform, particularly 4.3.0 and various updates.
What impact does CVE-2010-4265 have on my systems?
CVE-2010-4265 could allow an attacker to cause a denial of service, impacting the availability of the affected JBoss applications.
Is CVE-2010-4265 related to CVE-2010-3862?
Yes, CVE-2010-4265 has a connection with CVE-2010-3862 as it was expected to fix that vulnerability, but it did not.