The agent in Thermostat before 1.0.6, when using unspecified configurations, allows local users to obtain the JMX management URLs of all local Java virtual machines and gain privileges via unknown vectors.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:2000 advisory.

    Thermostat is a monitoring and instrumentation tool for the OpenJDK HotSpot     Java Virtual Machine (JVM) with support for monitoring multiple JVM     instances.

    It was discovered that, in certain configurations, the Thermostat agent     disclosed JMX management URLs of all local Java virtual machines to any     local user. A local, unprivileged user could use this flaw to escalate     their privileges on the system. (CVE-2014-8120)

    This issue was discovered by Elliott Baron of Red Hat.

    All thermostat1-thermostat users are advised to upgrade to these updated     packages, which contain a backported patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Update to latest maintenance release. It was discovered that, in certain configurations, the Thermostat agent disclosed JMX management URLs of all local Java virtual machines to any local user. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-8120)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
233018	RHEL 6 / 7 : thermostat1-thermostat (RHSA-2014:2000)	Nessus	Red Hat Local Security Checks	Local	high
80423	Fedora 20 : thermostat-1.0.6-1.fc20 (2014-17415)	Nessus	Fedora Local Security Checks	Local	medium
80422	Fedora 21 : thermostat-1.0.6-1.fc21 (2014-17384)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2014-8120

high

Tenable Plugins

high

medium

medium