REDHAT-BUG-1273046
First published: Mon Oct 19 2015(Updated: )
It was found that JBoss EAP did not properly authorize a user performing a shut down. An user with the role Monitor, Deployer, or Auditor could use this flaw to shut down the EAP server, which is an action restricted to admin users. The following commits introduced this issue: <a href="https://github.com/wildfly/wildfly-core/commit/6e5611b4c6">https://github.com/wildfly/wildfly-core/commit/6e5611b4c6</a> <a href="https://github.com/jbossas/jboss-eap/commit/a905e9a041">https://github.com/jbossas/jboss-eap/commit/a905e9a041</a> The context.getServiceRegistry call, which throws an exception when authorization fails, was replaced with a call to context.authorize, which only returns an authorization result.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/wildfly/wildfly-core/commit/6e5611b4c6
- https://github.com/jbossas/jboss-eap/commit/a905e9a041
- https://rhn.redhat.com/errata/RHSA-2015-2541.html
- https://rhn.redhat.com/errata/RHSA-2015-2539.html
- https://rhn.redhat.com/errata/RHSA-2015-2538.html
- https://rhn.redhat.com/errata/RHSA-2015-2540.html
- https://rhn.redhat.com/errata/RHSA-2015-2542.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1273046
Frequently Asked Questions
What is the severity of REDHAT-BUG-1273046?
The severity of REDHAT-BUG-1273046 is considered high due to unauthorized shutdown capabilities affecting JBoss EAP.
How do I fix REDHAT-BUG-1273046?
To fix REDHAT-BUG-1273046, ensure that only admin users are authorized to perform server shutdowns by applying the recommended patches from Red Hat.
What versions of JBoss EAP are affected by REDHAT-BUG-1273046?
REDHAT-BUG-1273046 affects all versions of JBoss EAP that do not have the necessary patches applied.
Who can exploit REDHAT-BUG-1273046?
Any user with the roles Monitor, Deployer, or Auditor can exploit REDHAT-BUG-1273046 to shut down the EAP server.
What impact does REDHAT-BUG-1273046 have on organizations?
The impact of REDHAT-BUG-1273046 can lead to service disruptions and loss of availability for applications running on the JBoss EAP server.
- agent/references
- agent/last-modified-date
- agent/first-publish-date
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-5304
- agent/severity
- agent/event
- agent/description
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat jboss enterprise application platform