Loading vulnerability…
JacORB Security-Domain Attribute Information Disclosure
CVE-2014-7853 is an information-disclosure vulnerability in the JacORB subsystem of JBoss Application Server (WildFly), affecting Red Hat JBoss Enterprise Application Platform (EAP) releases before 6.3.3. The security-domain attribute was assigned the socket-binding-ref sensitivity classification rather than the required security-domain-ref classification. This authorization-classification error allowed users permitted to read socket-binding-ref-sensitive attributes to access sensitive information held in the security-domain attribute, despite lacking authorization for security-domain-ref-sensitive attributes.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated user with a partially privileged management role can bypass intended attribute-level access controls and disclose sensitive security-domain information. The issue is primarily a confidentiality failure; the supplied vulnerability descriptions do not establish direct code execution, service disruption, or configuration modification through this flaw.
If you can’t patch tonight, do this now.
Until updates are installed, restrict management access and remove socket-binding-ref attribute permissions from roles that do not also require access to security-domain information. Review role-based access-control assignments for users with management-plane access and limit access to trusted administrators.
Patch, then assume compromise.
Update affected Red Hat JBoss EAP deployments to the corrected 6.3.3 packages or the applicable vendor-provided update stream. Red Hat provided fixes through RHSA-2015:0215 for EAP 6.3, RHSA-2015:0216 for RHEL 5 component packages, RHSA-2015:0217 for RHEL 6, RHSA-2015:0218 for RHEL 7, and RHSA-2015:0920 for Red Hat JBoss Operations Network 3.3. Restart the JBoss server process after installation for the corrected classification to take effect.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.