CVE Database

CVE-2012-3369

Impact: Low
Public: 2013-01-24
Bugzilla: 836451: CVE-2012-3369 JBoss: CallerIdentityLoginModule retaining password from previous call if a null password is provided

Details

The MITRE CVE dictionary describes this issue as:

The CallerIdentityLoginModule in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to gain privileges of the previous user via a null password, which causes the previous user's password to be used.

Find out more about CVE-2012-3369 from the MITRE CVE dictionary and NIST NVD.

CVSS v2 metrics

Base Score: 4
Base Metrics: AV:N/AC:H/Au:N/C:P/I:P/A:N
Access Vector: Network
Access Complexity: High
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: Partial
Availability Impact: None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat security errata

Platform Errata Release Date
JBoss Enterprise BRMS Platform 5.3 RHSA-2013:0221 January 31, 2013
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS (jbossas) RHSA-2013:0193 January 24, 2013
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server (jbossas) RHSA-2013:0192 January 24, 2013
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server (jbossas) RHSA-2013:0191 January 24, 2013
Red Hat JBoss Enterprise Application Platform 5.2 RHSA-2013:0194 January 24, 2013
Red Hat JBoss SOA Platform 5.3 RHSA-2013:0533 February 20, 2013
Red Hat JBoss Web Platform 5 for RHEL 4 AS (jbossas-web) RHSA-2013:0197 January 24, 2013
Red Hat JBoss Web Platform 5 for RHEL 5 Server (jbossas-web) RHSA-2013:0196 January 24, 2013
Red Hat JBoss Web Platform 5 for RHEL 6 Server (jbossas-web) RHSA-2013:0195 January 24, 2013
Red Hat JBoss Web Platform 5.2 RHSA-2013:0198 January 24, 2013

External References

Acknowledgements

This issue was discovered by Carlo de Wolf of Red Hat.

This page is generated automatically and has not been checked for errors or omissions.

For clarification or corrections please contact the Red Hat Security Response Team.