Red Hat JBoss EAP 6.4.14 Fixes Local Root Escalation and DoS Flaws
Attack Tradecraft · 16 sources · Updated 2mo ago · First seen May 2, 2017
Red Hat released JBoss Enterprise Application Platform (EAP) 6.4.14 to replace 6.4.13 and remediate three security flaws across EAP 6 packages for supported RHEL 5, 6, and 7 deployments, including jboss-ec2-eap. CVE-2016-8657 allowed local members of the jboss group to modify the group-writable /etc/sysconfig/jbossas file; on RHEL 6 and earlier systems using legacy /etc/init.d service scripts, that file was sourced with root privileges during JBoss service operations, enabling local privilege escalation.
The release also fixes CVE-2017-6056, an Apache Tomcat HTTPS request-processing flaw that could trigger an infinite loop and denial of service, and CVE-2016-6346, where RESTEasy's GZIPInterceptor could be unnecessarily enabled and permit denial of service. Red Hat advised customers to back up EAP installations and deployed applications before updating. The vendor clarified that the initial ZIP-distribution advisory did not resolve CVE-2016-8657, because the affected writable configuration file was present in RPM-based installations.
