Description
Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular Service Container (MSC) service registry, which allows local users to modify the server via a crafted deployment.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | hornetq | 2.3.14-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jacorb-jboss | 2.3.2-13.redhat_6.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jboss-as-cli +6 | 7.3.1-4.Final_redhat_3.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jboss-as-cmp +25 | 7.3.1-2.Final_redhat_3.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jboss-as-ee +19 | 7.3.1-3.Final_redhat_3.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jboss-logmanager | 1.5.2-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jboss-marshalling | 1.4.3-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jboss-xnio-base | 3.0.9-1.GA_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jbossas-core | 7.3.1-5.Final_redhat_3.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.3.1-3.Final_redhat_3.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jbossas-modules-eap | 7.3.1-6.Final_redhat_3.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | jbossweb | 7.3.0-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | netty | 3.6.7-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | picketbox | 4.0.19-2.SP3_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | weld-core | 1.1.17-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | xml-security | 1.5.6-1.redhat_1.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
| Red Hat JBoss EAP 6 | xmltooling | 1.3.4-5.redhat_3.1.ep6.el5 | RHSA-2014:0171, RHSA-2014:0170 |
Advisories 2
- RHSA-2014:0170 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0171 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- RHSA-2014:0170 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1052783
- RHSA-2014:0172 vendor-advisory
- 65591 vdb-entry
- RHSA-2014:0171 vendor-advisory