RHEL 6 : jboss-ec2-eap (RHSA-2012:1376)

This script is Copyright (C) 2013-2014 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing a security update.

Description :

An updated jboss-ec2-eap package that fixes one security issue is now
available for JBoss Enterprise Application Platform 5.1.2 for Red Hat
Enterprise Linux 6 running on the Amazon Web Services (AWS) Elastic
Compute Cloud (EC2).

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available from the
CVE link in the References section.

jboss-ec2-eap provides JBoss Operations Network (JBoss ON) scripts for
JBoss Enterprise Application Platform running on the Amazon Web
Services (AWS) Elastic Compute Cloud (EC2).

It was found that the '/var/cache/jboss-ec2-eap/' directory had world
readable permissions when using the EC2 AMI (Amazon Machine Image) for
JBoss Enterprise Application Platform 5.1.2 on Red Hat Enterprise
Linux 6. A local attacker could use this flaw to read potentially
sensitive information from this directory, such as Amazon Web Services
(AWS) credentials. (CVE-2012-3427)

Note: This flaw only affected the EC2 AMI for JBoss Enterprise
Application Platform 5.1.2.

This issue was discovered by Aleksandar Kostadinov of the Red Hat QE
Team.

Warning: Before applying this update, back up your JBoss Enterprise
Application Platform's 'server/[PROFILE]/deploy/' directory, along
with all other customized configuration files.

Users of JBoss Enterprise Application Platform 5.1.2 on Red Hat
Enterprise Linux 6 running on EC2 should upgrade to this updated
package, which corrects this issue. The JBoss server process must be
restarted for this update to take effect.

See also :

https://www.redhat.com/security/data/cve/CVE-2012-3427.html
http://rhn.redhat.com/errata/RHSA-2012-1376.html

Solution :

Update the affected jboss-ec2-eap package.

Risk factor :

Low / CVSS Base Score : 2.1
(CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS Temporal Score : 1.7
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true

Family: Red Hat Local Security Checks

Nessus Plugin ID: 64058 ()

Bugtraq ID: 55945

CVE ID: CVE-2012-3427