JBoss Enterprise Application Platform Class Files Information Disclosure Vulnerability

Bugtraq ID:	31300
Class:	Configuration Error
CVE:	CVE-2008-3519
Remote:	Yes
Local:	No
Published:	Sep 22 2008 12:00AM
Updated:	Sep 22 2008 08:49PM
Credit:	JBoss Group
Vulnerable:	Redhat JBoss Enterprise Application Platform 4.3 EL5 Redhat JBoss Enterprise Application Platform 4.3 EL4 Redhat JBoss Enterprise Application Platform 4.3 .CP01 Redhat JBoss Enterprise Application Platform 4.3 Redhat JBoss Enterprise Application Platform 4.2 EL5 Redhat JBoss Enterprise Application Platform 4.2 EL4 Redhat JBoss Enterprise Application Platform 4.2 .CP03 Redhat JBoss Enterprise Application Platform 4.2
Not Vulnerable:	Redhat JBoss Enterprise Application Platform 4.3 .CP02 Redhat JBoss Enterprise Application Platform 4.2 .CP04

JBoss Enterprise Application Platform Class Files Information Disclosure Vulnerability

JBoss Enterprise Application Platform is prone to a remote information-disclosure vulnerability.

Remote attackers can exploit this issue to obtain class files from the server class path. Information obtained may lead to further attacks.

JBoss Enterprise Application Platform Class Files Information Disclosure Vulnerability

An attacker will likely exploit this issue through a browser.

JBoss Enterprise Application Platform Class Files Information Disclosure Vulnerability

Solution:
The vendor has released updates. Please see the references for more information.

JBoss Enterprise Application Platform Class Files Information Disclosure Vulnerability

References:

• CVE-2008-3519 JBossEAP allows download of non-EJB class files (Red Hat)
  
• JBoss Enterprise Application Platform 4.2 Release Notes CP04 (Red Hat)
  
• JBoss Enterprise Application Platform 4.3 Release Notes CP02 (Red Hat)
  
• JBoss Portal Homepage (JBoss Group)