JBoss RichFaces 'do' Parameter Remote Code Execution Vulnerability

Bugtraq ID:	73370
Class:	Unknown
CVE:	CVE-2015-0279
Remote:	Yes
Local:	No
Published:	Feb 12 2015 12:00AM
Updated:	Feb 12 2015 12:00AM
Credit:	Takeshi Terada
Vulnerable:	Redhat Richfaces 4.5.2 Redhat Richfaces 4.5.0 Redhat Richfaces 4.3.5 Redhat Richfaces 4.3.4 Redhat Richfaces 4.3.3 Redhat Richfaces 4.3.1 Redhat Richfaces 4.3.0 Redhat Richfaces 4.2.3 Redhat Richfaces 4.2.2 Redhat Richfaces 4.2.1 Redhat Richfaces 4.2.0 Redhat Richfaces 4.1.0 Redhat Richfaces 4.0.0 Redhat Richfaces 3.3.2 Redhat Richfaces 3.3.1 Redhat Richfaces 3.3.0 Redhat Richfaces 3.2.2 Redhat Richfaces 3.2.1 Redhat Richfaces 3.2.0 Redhat Richfaces 3.1.5 Redhat Richfaces 3.1.4 Redhat Richfaces 3.1.3 Redhat Richfaces 3.1.2 Redhat Richfaces 3.1.1 Redhat Richfaces 3.1.0 Redhat JBoss Web Framework Kit 2.7.0
Not Vulnerable:	Redhat Richfaces 4.5.4

JBoss RichFaces 'do' Parameter Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

JBoss RichFaces 'do' Parameter Remote Code Execution Vulnerability

References:

• Bug 1192140 - (CVE-2015-0279) CVE-2015-0279 RichFaces: Remote Command Execution (Red Hat Bugzilla)
  
• RichFaces Homepage (JBoss Community)
  
• Important: Red Hat JBoss Web Framework Kit 2.7.0 security update (Red Hat)