[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAH5b-BWT+=sWPPYT8gVA60Agw4EDU-b+tOJfprmxZgjUMSfbEw@mail.gmail.com>
Date: Fri, 20 Jul 2012 18:12:53 +0200
From: yersinia <yersinia.spiros@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE for JBOSS EAP 5.0(twiddle and jmx invocations) ?
Following this apparently RFE on JBOSS
https://issues.jboss.org/browse/JBPAPP-3391?_sscc=t
i have found a nice description, and an proposed patch, about it here
http://objectopia.com/2009/10/01/securing-jmx-invoker-layer-in-jboss/.
But the last link describe - apparently - a serious bug in the JBoss JMX
Invoker Layer, a missing authentication that can
produce a serious problem. Reading the other response i don't think there
is today the possibility to enforce a true mitigation
in JBOSS, apart putting in place some form a network control (aka a
firewall). This is for JBOSS 5.0, i know that twiddle is no longer
in JBoss EAP 6.0 which provides a totally new, much improved, secure and
scriptable management interface.
Do you think this can require a CVE for JBOSS EAP 5?
Thanks in advance
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
