Loading vulnerability…
Unchecked MSC Service Registry Access in JBoss EAP under Java Security Manager
CVE-2014-0018 is a missing-authorization vulnerability in the JBoss AS server component of Red Hat JBoss Enterprise Application Platform 6.2.0 and affected JBoss WildFly Application Server releases. When operated under a Java Security Manager, deployed code could obtain access to the Modular Service Container (MSC) service registry without required permission checks. A malicious deployment could use this access to alter internal JBoss server state.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A local attacker able to deploy malicious application code can modify the application server's internal state through unauthorized access to the MSC service registry. Red Hat assessed the issue as having partial integrity impact, with no confidentiality or availability impact in its CVSS v2 assessment.
If you can’t patch tonight, do this now.
Until updates can be applied, prevent untrusted users from deploying or modifying application deployments and restrict local access to the application-server host and deployment-management interfaces. Review existing deployments and remove untrusted applications. Do not rely on the Java Security Manager alone to isolate untrusted deployed code on affected versions.
Patch, then assume compromise.
Apply the applicable Red Hat security update. JBoss EAP 6.2.0 users should upgrade to EAP 6.2.1 or the corresponding fixed package stream. Fixed updates were also provided for affected EAP 6 packages and related JBoss BPMS, BRMS, Fuse Service Works, and Portal releases. Restart the JBoss server process after updating.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.