Description
The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform (aka JBossEAP or EAP), possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote attackers to obtain sensitive information (non-EJB classes) via a download request, a different vulnerability than CVE-2008-3273.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 4 | glassfish-jaf | 1.1.0-0jpp.ep1.12.el5.1 | RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | glassfish-javamail | 1.4.0-0jpp.ep1.10.el4 | RHSA-2008:0833, RHSA-2008:0832, RHSA-2008:0831 |
| Red Hat JBoss EAP 4 | glassfish-jaxb +1 | 2.1.4-1jpp.ep1.2.el4 | RHSA-2008:0832, RHSA-2008:0831 |
| Red Hat JBoss EAP 4 | glassfish-jaxws | 2.1.1-1jpp.ep1.3.el4 | RHSA-2008:0832, RHSA-2008:0831 |
| Red Hat JBoss EAP 4 | glassfish-jstl | 1.2.0-0jpp.ep1.10.el5 | RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | hibernate3 +1 | 1:3.2.4-1.SP1_CP04.0jpp.ep1.3.el4 | RHSA-2008:0834, RHSA-2008:0833, RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | hibernate3-annotations +1 | 3.2.1-4.GA_CP02.1jpp.ep1.7.el4 | RHSA-2008:0834, RHSA-2008:0833, RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | hibernate3-commons-annotations | 0.0.0-1.1jpp.ep1.1.el5 | RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | hibernate3-entitymanager +1 | 3.2.1-2.GA_CP03.1jpp.ep1.9.el5 | RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | hibernate3-validator | 0.0.0-1.1jpp.ep1.1.el4 | RHSA-2008:0833, RHSA-2008:0832, RHSA-2008:0831 |
| Red Hat JBoss EAP 4 | javassist | 3.8.0-1.ep1.el4 | RHSA-2008:0832, RHSA-2008:0831 |
| Red Hat JBoss EAP 4 | jboss-aop | 1.5.5-2.CP02.0jpp.ep1.2.el4 | RHSA-2008:0834, RHSA-2008:0833, RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | jboss-jaxr | 1.2.0-SP1.0jpp.ep1.4.el5 | RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | jboss-messaging | 1.4.0-1.SP3_CP03.0jpp.ep1.3.el4 | RHSA-2008:0832, RHSA-2008:0831 |
| Red Hat JBoss EAP 4 | jboss-remoting | 2.2.2-3.SP9.0jpp.ep1.1.el4 | RHSA-2008:0834, RHSA-2008:0833, RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | jboss-seam +1 | 1.2.1-1.ep1.9.el5 | RHSA-2008:0834, RHSA-2008:0833, RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | jbossas | 4.2.0-3.GA_CP04.ep1.8.el4 | RHSA-2008:0834, RHSA-2008:0833, RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | jbossts | 1:4.2.3-1.SP5_CP02.1jpp.ep1.1.el4 | RHSA-2008:0834, RHSA-2008:0833, RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | jbossweb | 2.0.0-4.CP06.0jpp.ep1.1.el4 | RHSA-2008:0834, RHSA-2008:0833, RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | jbossws | 2.0.1-2.SP2_CP03.0jpp.ep1.1.el4 | RHSA-2008:0832, RHSA-2008:0831 |
| Red Hat JBoss EAP 4 | jbossws-common | 1.0.0-1.GA_CP01.0jpp.ep1.3.el4 | RHSA-2008:0832, RHSA-2008:0831 |
| Red Hat JBoss EAP 4 | jbossws-framework | 2.0.1-0jpp.ep1.11.el4 | RHSA-2008:0832, RHSA-2008:0831 |
| Red Hat JBoss EAP 4 | jbossxb | 1.0.0-2.SP3.0jpp.ep1.3.el5.1 | RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | rh-eap-docs +1 | 4.2.0-4.GA_CP04.ep1.3.el5 | RHSA-2008:0834, RHSA-2008:0833, RHSA-2008:0832 |
Advisories 4
- RHSA-2008:0834 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0CP04 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0833 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0CP04 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0831 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0CP02 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0832 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0CP02 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=458823
- http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3.0.cp02/html-single/readme/index.html
- http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp04/html-single/readme/index.html
- RHSA-2008:0832 vendor-advisory
- RHSA-2008:0833 vendor-advisory
- RHSA-2008:0831 vendor-advisory
- RHSA-2008:0834 vendor-advisory
- 31300 vdb-entry
- jboss-downloadserverclasses-info-disclosure(45305) vdb-entry
- 1020905 vdb-entry