RedHat JBoss Enterprise Application Platform CVE-2016-3690 Remote Code Execution Vulnerability
BID:99079
Info
RedHat JBoss Enterprise Application Platform CVE-2016-3690 Remote Code Execution Vulnerability
| Bugtraq ID: | 99079 |
| Class: | Unknown |
| CVE: |
CVE-2016-3690 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 15 2017 12:00AM |
| Updated: | Jun 15 2017 12:00AM |
| Credit: | Dennis Reed, Red Hat |
| Vulnerable: |
Redhat Jboss Enterprise Soa Platform 5.0 Redhat Jboss Enterprise Soa Platform 4.0 Redhat JBoss Enterprise BRMS Platform 5 Redhat JBoss Enterprise Application Platform 5.2 Redhat JBoss Enterprise Application Platform 5.0 Redhat JBoss Enterprise Application Platform 4.3 Redhat JBoss Enterprise Application Platform 4.2 Redhat JBoss Enterprise Application Platform 4.0.5 Redhat JBoss Enterprise Application Platform 4.0.4 Redhat JBoss Enterprise Application Platform 5.1.2 Redhat JBoss Enterprise Application Platform 5.1.1 Redhat JBoss Enterprise Application Platform 5.1.0 Redhat JBoss Enterprise Application Platform 5.0.1 Redhat JBoss Enterprise Application Platform 4.0 |
| Not Vulnerable: | |
Discussion
RedHat JBoss Enterprise Application Platform CVE-2016-3690 Remote Code Execution Vulnerability
RedHat JBoss Enterprise Application Platform is prone to a remote code-execution vulnerability.
Successfully exploiting this issue will allow attackers to execute arbitrary code within the context of the application.
RedHat JBoss Enterprise Application Platform 4.x and 5.x are vulnerable; other versions may also be affected.
RedHat JBoss Enterprise Application Platform is prone to a remote code-execution vulnerability.
Successfully exploiting this issue will allow attackers to execute arbitrary code within the context of the application.
RedHat JBoss Enterprise Application Platform 4.x and 5.x are vulnerable; other versions may also be affected.
Exploit / POC
RedHat JBoss Enterprise Application Platform CVE-2016-3690 Remote Code Execution Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
RedHat JBoss Enterprise Application Platform CVE-2016-3690 Remote Code Execution Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
RedHat JBoss Enterprise Application Platform CVE-2016-3690 Remote Code Execution Vulnerability
References:
References:
- CVE-2016-3690 (Red Hat)
- How to disable the Pooled Invoker in JBoss EAP 4.x/5.x (Red Hat)
- How to restrict jmx invoker to localhost in JBoss EAP? (Red Hat)
- JBoss Enterprise Application Platform Homepage (Red Hat)
- Bug 1327037 - (CVE-2016-3690) CVE-2016-3690 PooledInvokerServlet is not secured (Red Hat)