Red Hat Enterprise Application Platform and WildFly Insecure File Permissions Vulnerability

Bugtraq ID:	74266
Class:	Design Error
CVE:	CVE-2014-3586
Remote:	No
Local:	Yes
Published:	Apr 22 2015 12:00AM
Updated:	Apr 22 2015 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Redhat JBoss Enterprise Application Platform 6.3 Redhat JBoss Enterprise Application Platform 6.3.2 Redhat JBoss Enterprise Application Platform 6.3.1 Redhat JBoss Enterprise Application Platform 6 EL6 Redhat JBoss Enterprise Application Platform 6 EL5 Redhat JBoss Application Server 0
Not Vulnerable:	Redhat JBoss Enterprise Application Platform 6.4

Red Hat Enterprise Application Platform and WildFly Insecure File Permissions Vulnerability

Red Hat Enterprise Application Platform and WildFly are is prone to an insecure file-permissions vulnerability.

A local attacker can exploit this issue to gain sensitive information. Information obtained may aid in other attacks.

Red Hat Enterprise Application Platform and WildFly Insecure File Permissions Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Red Hat Enterprise Application Platform and WildFly Insecure File Permissions Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Red Hat Enterprise Application Platform and WildFly Insecure File Permissions Vulnerability

References:

• CVE-2014-3586 JBoss AS CLI: Insecure default permissions on history file (Red Hat Bugzilla)
  
• JBoss Application Server Homepage (Red Hat)
  
• JBoss Enterprise Application Platform Homepage (Red Hat)
  
• RHSA-2015-0846 (Red Hat)
  
• RHSA-2015-0847 (Red Hat)
  
• RHSA-2015-0848 (Red Hat)
  
• RHSA-2015-0849 (Red Hat)