CVE-2014-0093
First published: Wed Feb 26 2014(Updated: )
IssueDescription: It was found that Java Security Manager permissions configured via a policy file were not properly applied, causing all deployed applications to be granted the java.security.AllPermission permission. In certain cases, an attacker could use this flaw to circumvent expected security measures to perform actions which would otherwise be restricted.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| JBoss Enterprise Application Platform | =6.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://rhn.redhat.com/errata/RHSA-2014-0345.html
- https://rhn.redhat.com/errata/RHSA-2014-0343.html
- https://rhn.redhat.com/errata/RHSA-2014-0344.html
- https://rhn.redhat.com/errata/RHSA-2014-1291.html
- https://rhn.redhat.com/errata/RHSA-2014-1290.html
- https://rhn.redhat.com/errata/RHSA-2014-1995.html
- https://rhn.redhat.com/errata/RHSA-2015-1009.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1070046
- http://rhn.redhat.com/errata/RHSA-2014-0343.html
- http://rhn.redhat.com/errata/RHSA-2014-0344.html
- http://rhn.redhat.com/errata/RHSA-2014-0345.html
- http://secunia.com/advisories/57675
- http://www.securityfocus.com/bid/66596
Frequently Asked Questions
What is the severity of CVE-2014-0093?
CVE-2014-0093 is classified as a critical vulnerability due to the potential for attackers to gain unauthorized access and control.
How do I fix CVE-2014-0093?
To fix CVE-2014-0093, update to the latest version of Red Hat JBoss Enterprise Application Platform that resolves this security issue.
What causes the vulnerability CVE-2014-0093?
CVE-2014-0093 is caused by improper configuration of Java Security Manager permissions that inadvertently grants all permissions to applications.
Which software versions are affected by CVE-2014-0093?
CVE-2014-0093 affects version 6.2.2 of Red Hat JBoss Enterprise Application Platform.
Can CVE-2014-0093 affect my applications?
Yes, CVE-2014-0093 can affect your applications by allowing attackers to execute actions with system-wide permissions.
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/severity
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2014-0093
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/redhat
- canonical/jboss enterprise application platform
- version/jboss enterprise application platform/6.2.2