CVE-2015-5304
First published: Mon Oct 19 2015(Updated: )
It was found that JBoss EAP did not properly authorize a user performing a shut down. An user with the role Monitor, Deployer, or Auditor could use this flaw to shut down the EAP server, which is an action restricted to admin users. The following commits introduced this issue: <a href="https://github.com/wildfly/wildfly-core/commit/6e5611b4c6">https://github.com/wildfly/wildfly-core/commit/6e5611b4c6</a> <a href="https://github.com/jbossas/jboss-eap/commit/a905e9a041">https://github.com/jbossas/jboss-eap/commit/a905e9a041</a> The context.getServiceRegistry call, which throws an exception when authorization fails, was replaced with a call to context.authorize, which only returns an authorization result.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Jboss Enterprise Application Platform | <=6.4.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/wildfly/wildfly-core/commit/6e5611b4c6
- https://github.com/jbossas/jboss-eap/commit/a905e9a041
- https://rhn.redhat.com/errata/RHSA-2015-2541.html
- https://rhn.redhat.com/errata/RHSA-2015-2539.html
- https://rhn.redhat.com/errata/RHSA-2015-2538.html
- https://rhn.redhat.com/errata/RHSA-2015-2540.html
- https://rhn.redhat.com/errata/RHSA-2015-2542.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1273046
- http://rhn.redhat.com/errata/RHSA-2015-2538.html
- http://rhn.redhat.com/errata/RHSA-2015-2539.html
- http://rhn.redhat.com/errata/RHSA-2015-2540.html
- http://rhn.redhat.com/errata/RHSA-2015-2541.html
- http://rhn.redhat.com/errata/RHSA-2015-2542.html
- http://www.securitytracker.com/id/1034280
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/tags
- agent/event
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-5304
- vendor/redhat
- canonical/redhat jboss enterprise application platform
- version/redhat jboss enterprise application platform/6.4.4