Vulnerability Description
The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly restrict write access, which allows remote attackers to add, delete, or modify items in a JNDI tree via unspecified vectors.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Jboss Enterprise Application Platform | 4.3.0 |
| Redhat | Jboss Enterprise Brms Platform | <= 5.2.0 |
| Redhat | Jboss Enterprise Portal Platform | 4.3.0 |
| Redhat | Jboss Enterprise Soa Platform | 4.2.0 |
| Redhat | Jboss Enterprise Web Platform | 5.1.2 |
Related Weaknesses (CWE)
References
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=766469
- http://rhn.redhat.com/errata/RHSA-2012-1022.html
- http://rhn.redhat.com/errata/RHSA-2012-1023.html
- http://rhn.redhat.com/errata/RHSA-2012-1024.html
- http://rhn.redhat.com/errata/RHSA-2012-1025.html
- http://rhn.redhat.com/errata/RHSA-2012-1026.html
- http://rhn.redhat.com/errata/RHSA-2012-1027.html
- http://rhn.redhat.com/errata/RHSA-2012-1028.html
- http://rhn.redhat.com/errata/RHSA-2012-1109.html
- http://rhn.redhat.com/errata/RHSA-2012-1125.html
- http://rhn.redhat.com/errata/RHSA-2012-1232.html
- http://rhn.redhat.com/errata/RHSA-2012-1295.html
- http://secunia.com/advisories/49656Vendor Advisory
- http://secunia.com/advisories/49658Vendor Advisory
- http://secunia.com/advisories/50084Vendor Advisory
FAQ
What is CVE-2011-4605?
CVE-2011-4605 is a vulnerability with a CVSS score of 7.5 (HIGH). The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP...
How severe is CVE-2011-4605?
CVE-2011-4605 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2011-4605?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Brms Platform, Redhat Jboss Enterprise Portal Platform, Redhat Jboss Enterprise Soa Platform, Redhat Jboss Enterprise Web Platform.