[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 23 Jul 2012 15:35:46 +1000
From: David Jorm <djorm@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE for JBOSS EAP 5.0(twiddle and jmx invocations)
?
On 07/21/2012 02:12 AM, yersinia wrote:
> Following this apparently RFE on JBOSS
> https://issues.jboss.org/browse/JBPAPP-3391?_sscc=t
> i have found a nice description, and an proposed patch, about it here
> http://objectopia.com/2009/10/01/securing-jmx-invoker-layer-in-jboss/.
>
> But the last link describe - apparently - a serious bug in the JBoss JMX
> Invoker Layer, a missing authentication that can
> produce a serious problem. Reading the other response i don't think there
> is today the possibility to enforce a true mitigation
> in JBOSS, apart putting in place some form a network control (aka a
> firewall). This is for JBOSS 5.0, i know that twiddle is no longer
> in JBoss EAP 6.0 which provides a totally new, much improved, secure and
> scriptable management interface.
>
> Do you think this can require a CVE for JBOSS EAP 5?
>
> Thanks in advance
>
Thanks for bringing this up. As I see it, there's two issues here:
1) twiddle.sh accepting credentials as command-line arguments, meaning
they could be exposed to another local user via a process listing
(JBPAPP-3391)
This issue affects JBoss AS 5 and EAP 5, but as you noted not AS 7 or
EAP 6. It is my opinion that this is indeed a low impact security flaw,
and a candidate for a CVE ID. I would give it the following CVSSv2
score: 2.1/AV:L/AC:L/Au:N/C:P/I:N/A:N. Kurt, can you please assign a CVE
ID for this flaw?
2) AuthenticationInterceptor in jmx-invoker-service.xml is commented out
by default, allowing unauthenticated access to the JMX Invoker
This issue only affects JBoss AS community releases, not EAP or other
supported JBoss products. The JBoss AS community releases prior to AS 7
opted for open by default configuration rather than secure by default
configuration. AS 7 and all supported JBoss products have secure
defaults applied. It is my opinion that this is a configuration and
documentation issue rather than a security issue. Documentation for
securing the invokers on JBoss AS community releases is available here:
https://community.jboss.org/wiki/SecureTheInvokers
Thanks
--
David Jorm / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
