The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2638 advisory.

    The jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on     the Amazon Web Services (AWS) Elastic Compute Cloud (EC2).

    With this update, the jboss-ec2-eap package has been updated to ensure compatibility with Red Hat JBoss     Enterprise Application Platform 6.4.17.

    Security Fix(es):

    * It was found that when using remote logging with log4j socket server the log4j server would deserialize     any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log     event that, during deserialization, would execute arbitrary code in the context of the logger application.
    (CVE-2017-5645)

    * A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A     crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of     the custom error page. (CVE-2017-5664)

    * A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user     to perform code execution by sending the maliciously crafted input to the readValue method of the     ObjectMapper. (CVE-2017-7525)

    Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting CVE-2017-7525.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 6 : jboss-ec2-eap (RHSA-2017:2638)

critical Nessus Plugin ID 103044

Version 3.15