CVE-2014-0093

Summary

Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2, when using a Java Security Manager (JSM), does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access restrictions.

Impact & exploitability

AV:N/AC:M/Au:N/C:P/I:P/A:N

Affected products we track (1)

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

• NVD record
• http://rhn.redhat.com/errata/RHSA-2014-0343.htmlAdvisory
• http://rhn.redhat.com/errata/RHSA-2014-0344.htmlAdvisory
• http://rhn.redhat.com/errata/RHSA-2014-0345.htmlAdvisory
• http://secunia.com/advisories/57675Advisory
• http://www.securityfocus.com/bid/66596