Loading vulnerability…
JBoss EAP Writable Init Configuration Privilege Escalation
CVE-2016-8657 is a local privilege-escalation vulnerability in certain Red Hat JBoss Enterprise Application Platform packages. A service initialization configuration file was installed as root-owned but writable by the jboss group. On Red Hat Enterprise Linux 6 and earlier systems using legacy SysV-style init scripts, the JBoss service script sourced this configuration as root during service start, stop, or restart operations. A jboss-group member could inject shell content into the configuration and have it executed with root privileges.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A local authenticated attacker who belongs to the jboss group can escalate to root. Successful exploitation provides arbitrary root-level command execution and consequently full compromise of confidentiality, integrity, and availability on the affected host.
If you can’t patch tonight, do this now.
Until patched, ensure the JBoss service initialization configuration is not writable by the jboss group or other non-administrative principals; restrict modifications to root or designated privileged administrators. Review and minimize membership in the jboss group, audit the configuration for unauthorized shell directives, and restrict use of legacy SysV init-based service management where feasible.
Patch, then assume compromise.
Apply the applicable Red Hat JBoss EAP security update. Red Hat corrected the issue in JBoss EAP 6.4.14; updates for EAP 6.4 were issued in RHSA-2017:0826, RHSA-2017:0827, RHSA-2017:0828, and RHSA-2017:0829. JBoss EAP 5 deployments on RHEL 5 and RHEL 6 should apply RHSA-2018:1609 or a later supported update. Back up the EAP installation and deployed applications before updating, consistent with vendor guidance.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.