Description
The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly restrict write access, which allows remote attackers to add, delete, or modify items in a JNDI tree via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Platform 5 | jboss-naming | 5.0.3-4.CP01_patch_01.1.ep5.el5 | RHSA-2012:1027 |
| Red Hat JBoss Web Platform 5 | jbossas-web +2 | 5.1.2-10.ep5.el5 | RHSA-2012:1027 |
| Red Hat JBoss EAP 5 | jboss-naming | 5.0.3-4.CP01_patch_01.1.ep5.el4 | RHSA-2012:1026 |
| Red Hat JBoss EAP 5 | jbossas +3 | 5.1.2-10.ep5.el4 | RHSA-2012:1026 |
| Red Hat JBoss EAP 4 | jbossas +1 | 4.3.0-10.GA_CP10_patch_01.1.ep1.el4 | RHSA-2012:1025 |
Advisories 3
- RHSA-2012:1027 Red Hat Security Advisory: jbossas-web and jboss-naming security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:1025 Red Hat Security Advisory: jbossas security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:1026 Red Hat Security Advisory: jbossas and jboss-naming security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- 1027501 vdb-entry
- 49656 third-party-advisory
- RHSA-2012:1028 vendor-advisory
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=766469
- 49658 third-party-advisory
- RHSA-2012:1109 vendor-advisory
- RHSA-2012:1025 vendor-advisory
- 50084 third-party-advisory
- RHSA-2012:1295 vendor-advisory
- RHSA-2012:1027 vendor-advisory
- 54644 vdb-entry
- RHSA-2012:1026 vendor-advisory
- 50549 third-party-advisory
- RHSA-2012:1024 vendor-advisory
- RHSA-2012:1232 vendor-advisory
- RHSA-2012:1022 vendor-advisory
- RHSA-2012:1023 vendor-advisory
- RHSA-2012:1125 vendor-advisory