Description
Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.5 does not properly authorize access to shut down the server, which allows remote authenticated users with the Monitor, Deployer, or Auditor role to cause a denial of service via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | apache-commons-collections-eap6 | 3.2.1-18.redhat_7.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | hibernate4-eap6 +4 | 4.2.21-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-7.SP6_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | ironjacamar-eap6 +9 | 1.0.34-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | jboss-as-ee +61 | 7.5.5-2.Final_redhat_3.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.5-3.Final_redhat_3.ep6.el6 | RHSA-2015:2542 |
| Red Hat JBoss EAP 6 | jboss-ejb-client | 1.0.32-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | jboss-hal +1 | 2.5.11-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | jboss-jsf-api_2.1_spec | 2.1.28-5.SP1_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | jboss-remoting3 | 3.3.6-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | jboss-security-negotiation | 2.3.10-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | jboss-xnio-base | 3.0.15-1.GA_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.5.5-3.Final_redhat_3.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.12-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | picketbox | 4.1.2-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
Advisories 4
- RHSA-2015:2542 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.5 jboss-ec2-eap update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:2539 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.5 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:2540 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.5 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:2538 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.5 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- RHSA-2015:2541 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1273046
- 1034280 vdb-entry
- RHSA-2015:2540 vendor-advisory
- RHSA-2015:2542 vendor-advisory
- RHSA-2015:2538 vendor-advisory
- RHSA-2015:2539 vendor-advisory