Input validation

The processInvocation function in org.jboss.as.ejb3.security.AuthorizationInterceptor in JBoss Enterprise Application Platform aka JBoss EAP or JBEAP before 6.0.1, authorizes all requests when no roles are allowed for an Enterprise Java Beans EJB method invocation, which allows attackers to bypas...

CVE-2012-4550

A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans EJB access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers JACC permissions from being...

CVE-2012-4549

A flaw was found in JBoss Enterprise Application Platform. The processInvocation function within the org.jboss.as.ejb3.security.AuthorizationInterceptor component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans EJB method invocation. This allows attacker...

Authorization

JBoss Enterprise Application Platform aka JBoss EAP or JBEAP before 6.0.1, when using role-based authorization for Enterprise Java Beans EJB access, does not call the intended authorization modules, which prevents JACC permissions from being applied and allows remote attackers to obtain access to...

CVE-2012-4549 Jboss enterprise application platform: org.jboss.as.ejb3: jboss enterprise application platform: access restriction bypass via improper ejb method authorization

A flaw was found in JBoss Enterprise Application Platform. The processInvocation function within the org.jboss.as.ejb3.security.AuthorizationInterceptor component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans EJB method invocation. This allows attacker...

CVE-2012-4550

CVE-2012-4550 affects Red Hat/JBoss EAP 6.x up to 6.0.1 where, during EJB access, the configured authorization modules (JACC/XACML) were not invoked, preventing JACC permissions from being enforced and allowing remote access to an EJB. The issue is mitigated by updating to JBoss EAP 6.0.1 (RHSA-2...

CVE-2012-4549

CVE-2012-4549 affects JBoss EAP/JBoss EAP Platform (JBoss EAP/JBEAP) prior to 6.0.1. The processInvocation() function in org.jboss.as.ejb3.security.AuthorizationInterceptor incorrectly authorizes all EJB method invocations when the allowed-roles list is empty, bypassing access controls. Red Hat/J...

CVE-2012-4550 Jboss enterprise application platform: jboss eap: jbeap: jboss enterprise application platform: unauthorized ejb access via authorization module bypass

A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans EJB access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers JACC permissions from being...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 6.0.1 update

JBoss Enterprise Application Platform 6.0.1, which fixes multiple security issues, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring...

FreeBSD : FreeBSD -- Insufficient message length validation for EAP-TLS messages (f115f693-36b2-11e2-a633-902b343deec9)

Problem description : The internal authentication server of hostapd does not sufficiently validate the message length field of EAP-TLS messages. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML databa...

FreeBSD Ports: FreeBSD

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2012 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2011-4605

The 1 JNDI service, 2 HA-JNDI service, and 3 HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly...

Authentication flaw

The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication ...

CVE-2011-4085

The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication ...

CVE-2011-4605

Summary: CVE-2011-4605 affects JBoss/JBossAS JNDI-related services. The vulnerability stems from insufficient access restrictions in the JNDI service, HA-JNDI service, and the HAJNDIFactory invoker servlet, allowing remote attackers to write to the JNDI tree. This could enable adding, deleting, o...

CVE-2011-4085

The CVE-2011-4085 description specifies an authentication bypass vulnerability in JBoss platforms where the servlets invoked by httpha-invoker (in JBoss EAP before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07) enforce access control only for GE...

FreeBSD -- Insufficient message length validation for EAP-TLS messages

Problem description: The internal authentication server of hostapd does not sufficiently validate the message length field of EAP-TLS messages...

FreeBSD-SA-12:07.hostapd

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-12:07.hostapd Security Advisory The FreeBSD Project Topic: Insufficient message length validation for EAP-TLS messages Category: contrib Module: wpa Announced:...

Fedora Update for hostapd FEDORA-2012-15748

Check for the Version of hostapd OpenVAS Vulnerability Test Fedora Update for hostapd FEDORA-2012-15748 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Fedora Update for hostapd FEDORA-2012-15759

Check for the Version of hostapd OpenVAS Vulnerability Test Fedora Update for hostapd FEDORA-2012-15759 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...