The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote attackers to bypass authentication and gain administrative access via direct requests.

The 'EBJInvokerServlet' and 'JMXInvokerServlet' servlets hosted on the web server on the remote host are accessible to unauthenticated users. The remote host is, therefore, affected by the following vulnerabilities :

  - A security bypass vulnerability exists due to improper     restriction of access to the console and web management     interfaces. An unauthenticated, remote attacker can     exploit this, via direct requests, to bypass     authentication and gain administrative access.
    (CVE-2007-1036)

  - A remote code execution vulnerability exists due to the     JMXInvokerHAServlet and EJBInvokerHAServlet invoker     servlets not properly restricting access to profiles. An     unauthenticated, remote attacker can exploit this to     bypass authentication and invoke MBean methods,     resulting in the execution of arbitrary code.
    (CVE-2012-0874)

  - A remote code execution vulnerability exists in the     EJBInvokerServlet and JMXInvokerServlet servlets due to     the ability to post a marshalled object. An     unauthenticated, remote attacker can exploit this, via a     specially crafted request, to install arbitrary     applications. Note that this issue is known to affect     McAfee Web Reporter versions prior to or equal to     version 5.2.1 as well as Symantec Workspace Streaming     version 7.5.0.493 and possibly earlier.
    (CVE-2013-4810)

According to its self-reported version number, the version of Cisco Prime Data Center Network Manager (DCNM) installed on the remote host is affected by a remote code execution vulnerability. Unauthorized users have access to the JBoss Application Server Remote Method Invocation services. A remote, unauthenticated attacker could exploit this to execute arbitrary code as SYSTEM (on Windows) or root (on Linux).

According to its self-reported version number, the version of Cisco Prime Data Center Network Manager (DCNM) installed on the remote host is affected by a remote code execution vulnerability. Unauthorized users have access to the JBoss Application Server Remote Method Invocation services. A remote, unauthenticated attacker could exploit this to execute arbitrary code as SYSTEM (on Windows) or root (on Linux).

This plugin determines if DCNM is vulnerable by checking the version number displayed in the web interface. The web interface is not available in older versions of DCNM.

ID	Name	Product	Family	Severity
70414	Apache Tomcat / JBoss EJBInvokerServlet / JMXInvokerServlet Multiple Vulnerabilities	Nessus	CGI abuses	critical
67248	Cisco Prime Data Center Network Manager RMI Remote Code Execution (credentialed check)	Nessus	Gain a shell remotely	critical
67247	Cisco Prime Data Center Network Manager RMI Remote Code Execution (uncredentialed check)	Nessus	Gain a shell remotely	critical

Detections

Analytics

CVE-2007-1036

critical

Tenable Plugins

critical

critical

critical