mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application
    Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which
    allows remote attackers to bypass access restrictions and gain access to applications deployed on the root
    context via unspecified vectors. (CVE-2012-1154)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:1053 advisory.

    mod_cluster is an Apache HTTP Server (httpd) based load balancer that     forwards requests from httpd to application server nodes. It can use the     AJP, HTTP, or HTTPS protocols for communication with application server     nodes.

    The JBoss Enterprise Web Platform 5.1.2 release (RHSA-2011:1804,     RHSA-2011:1803, RHSA-2011:1802) introduced a regression, causing     mod_cluster to register and expose the root context of a server by default,     even when ROOT was in the excludedContexts list in the mod_cluster     configuration. If an application was deployed on the root context, a remote     attacker could use this flaw to bypass intended access restrictions and     gain access to that application. (CVE-2012-1154)

    Warning: Before applying this update, back up your JBoss Enterprise Web     Platform's server/[PROFILE]/deploy/ directory and any other customized     configuration files.

    Users of JBoss Enterprise Web Platform 5.1.2 on Red Hat Enterprise Linux 4,     5, and 6 should upgrade to these updated packages, which correct this     issue. The JBoss server process must be restarted for this update to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:1166 advisory.

  - mod_cluster registers and exposes the root context of a server by default, despite ROOT being in the     excluded-contexts list (CVE-2012-1154)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated mod_cluster packages that fix one security issue are now available for JBoss Enterprise Application Platform 5.1.2 for Red Hat Enterprise Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

mod_cluster is an Apache HTTP Server (httpd) based load balancer that forwards requests from httpd to application server nodes. It can use the AJP, HTTP, or HTTPS protocols for communication with application server nodes.

The JBoss Enterprise Application Platform 5.1.2 release (RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798) introduced a regression, causing mod_cluster to register and expose the root context of a server by default, even when 'ROOT' was in the 'excludedContexts' list in the mod_cluster configuration. If an application was deployed on the root context, a remote attacker could use this flaw to bypass intended access restrictions and gain access to that application. (CVE-2012-1154)

Warning: Before applying this update, back up your JBoss Enterprise Application Platform's 'server/[PROFILE]/deploy/' directory, along with all other customized configuration files.

Users of JBoss Enterprise Application Platform 5.1.2 on Red Hat Enterprise Linux 4, 5, and 6 should upgrade to these updated packages, which correct this issue. The JBoss server process must be restarted for this update to take effect.

ID	Name	Product	Family	Severity
419016	SCA: security update for org.jboss.mod_cluster:mod_cluster (GHSA-v2fp-h4qx-x3r6)	Tenable Cloud Security	SCA Checks	medium
419016	SCA: security update for org.jboss.mod_cluster:mod_cluster (GHSA-v2fp-h4qx-x3r6)	Tenable Self-Hosted Container Security	SCA Checks	medium
193679	RHEL 5 / 6 : mod_cluster (RHSA-2012:1053)	Nessus	Red Hat Local Security Checks	medium
78929	RHEL 5 / 6 : mod_cluster (RHSA-2012:1166)	Nessus	Red Hat Local Security Checks	medium
64045	RHEL 5 / 6 : mod_cluster (RHSA-2012:1052)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2012-1154

medium

Tenable Plugins

medium

medium

medium

medium

medium