Vulnerability Note VU#632656

JBoss Application Server may not properly restrict access to the administrative interface

Original Release date: 20 Feb 2007 | Last revised: 21 Feb 2007

Overview

The JBoss Application Server may allow unauthenticated, remote access to the administrative console.

Description

JBoss is an open source application server implemented in Java. Because it is Java-based, JBoss can be used on any operating system that supports Java. JBoss servers can be remotely managed through a web-based administrative interface.

If JBoss is installed without using the advanced installer options, the JBoss security features will need to be configured manually. If a JBoss server is configured to allow unauthenticated access to the administrative interface, and is accessible from a remote network, then an attacker may be able to access and modify data on the server.

Note that it may be possible to enumerate vulnerable servers by using search engines.

Impact

A remote, unauthenticated attacker may be able to gain administrative access to a JBoss Application Server. Once an attacker has access, they may be able to access and modify data on that server.

Solution

Use the installer
Using the advanced installer options will configure JBoss to only allow authenticated administrative access.


Enable role based security

Enabling role based security may mitigate this vulnerability. See the SecureTheJmxConsole page on the JBoss wiki for more information.

Restrict access

Restricting access to the administrative interface to trusted hosts may mitigate this vulnerability. See the LimitAccessToCertainClients page on the JBoss wiki for more information.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Red Hat, Inc.Affected-21 Feb 2007
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

This vulnerability was reported by Ben Dexter.

This document was written by Ryan Giobbi.

Other Information

  • CVE IDs: CVE-2007-1036
  • Date Public: 20 Feb 2007
  • Date First Published: 20 Feb 2007
  • Date Last Updated: 21 Feb 2007
  • Severity Metric: 2.25
  • Document Revision: 32

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.