CVE-2012-3428: Medium severity JBoss IronJacamar vulnerability
The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource connection in opportunistic circumstances via an invalid connection attempt.
Other sources
When using multi-user authentication provided by the "allow-multiple-users" option for the datasource's connection pool together with a security domain, the credentials provided as arguments to the getConnection(uid,pwd) function are ignored. This means that a valid connection will be returned for an invalid credential.
This could also mean that, provided the correct subject, a datasource connection can be obtained that which might belong to a privileged user.
A fix for this issue is already available up-stream. The up-stream fix is located at [jira JBJCA-864].
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3428?
CVE-2012-3428 has a medium severity rating due to potential unauthorized access to data sources.
How do I fix CVE-2012-3428?
To fix CVE-2012-3428, upgrade IronJacamar to version 1.0.12.Final or later.
What impacts does CVE-2012-3428 have on JBoss Application Server?
CVE-2012-3428 allows remote attackers to access arbitrary datasources, compromising application security.
Which versions of IronJacamar are affected by CVE-2012-3428?
CVE-2012-3428 affects all versions of IronJacamar before 1.0.12.Final.
Is it safe to enable allow-multiple-users setting in IronJacamar with CVE-2012-3428?
No, enabling allow-multiple-users in conjunction with a security domain poses a security risk in light of CVE-2012-3428.