JBoss Enterprise Application Platform Insecure Directory Permissions Vulnerability

Bugtraq ID:	55945
Class:	Design Error
CVE:	CVE-2012-3427
Remote:	No
Local:	Yes
Published:	Oct 16 2012 12:00AM
Updated:	Oct 16 2012 12:00AM
Credit:	Aleksandar Kostadinov of the Red Hat QE Team
Vulnerable:	Red Hat JBoss Enterprise Application Platform 5.1.2 Red Hat JBoss Enterprise Application Platform 5 EL6 Red Hat Enterprise Linux 6 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0
Not Vulnerable:

JBoss Enterprise Application Platform Insecure Directory Permissions Vulnerability

JBoss Enterprise Application Platform is prone to a security vulnerability because it sets insecure directory permissions.

A local attacker can exploit this issue to obtain sensitive information such as Amazon Web Services (AWS) credentials. This may aid in further attacks.

JBoss Enterprise Application Platform 5 EL6 is affected; other versions may also be vulnerable.

JBoss Enterprise Application Platform Insecure Directory Permissions Vulnerability

Attackers can use readily available tools to exploit this issue.

JBoss Enterprise Application Platform Insecure Directory Permissions Vulnerability

Solution:
Updates are available. Please see the references for more information.

JBoss Enterprise Application Platform Insecure Directory Permissions Vulnerability

References:

• JBoss Enterprise Application Platform Homepage (Red Hat)