CVE-2014-0093: Medium severity redhat JBoss Enterprise Application Platform vulnerability
IssueDescription:
It was found that Java Security Manager permissions configured via a policy file were not properly applied, causing all deployed applications to be granted the java.security.AllPermission permission. In certain cases, an attacker could use this flaw to circumvent expected security measures to perform actions which would otherwise be restricted.
Other sources
Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2, when using a Java Security Manager (JSM), does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access restrictions.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Red Hat JBoss Enterprise Application Platform (JBEAP)to a version that resolves this vulnerability.Fixed in 6.2.2 - Configuration
Ensure the Java Security Manager permissions defined in the policy file are properly applied so deployed applications are not granted java.security.AllPermission (since in the affected case permissions were not applied and all applications received java.security.AllPermission).
Java Security Manager (JSM) permissions via policy file java.security.AllPermission = not granted
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0093?
CVE-2014-0093 is classified as a critical vulnerability due to the potential for attackers to gain unauthorized access and control.
How do I fix CVE-2014-0093?
To fix CVE-2014-0093, update to the latest version of Red Hat JBoss Enterprise Application Platform that resolves this security issue.
What causes the vulnerability CVE-2014-0093?
CVE-2014-0093 is caused by improper configuration of Java Security Manager permissions that inadvertently grants all permissions to applications.
Which software versions are affected by CVE-2014-0093?
CVE-2014-0093 affects version 6.2.2 of Red Hat JBoss Enterprise Application Platform.
Can CVE-2014-0093 affect my applications?
Yes, CVE-2014-0093 can affect your applications by allowing attackers to execute actions with system-wide permissions.