Public Date:
958618: CVE-2013-2035 HawtJNI: predictable temporary file name leading to local arbitrary code execution
The HawtJNI Library class wrote native libraries to a predictable file name in /tmp when the native libraries were bundled in a JAR file, and no custom library path was specified. A local attacker could overwrite these native libraries with malicious versions during the window between when HawtJNI writes them and when they are executed.

Find out more about CVE-2013-2035 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v2 metrics

NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.

Base Score 3.3
Base Metrics AV:L/AC:M/Au:N/C:P/I:P/A:N
Access Vector Local
Access Complexity Medium
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat JBoss BPMS 6.0 RHSA-2014:1291 2014-09-23
Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server RHSA-2013:1785 2013-12-04
Fuse MQ Enterprise 7.1.0 RHSA-2013:1029 2013-07-09
RHOSE Client 2.0 (activemq) RHSA-2014:0245 2014-03-03
Red Hat JBoss Enterprise Application Platform 6.2 RHSA-2013:1784 2013-12-04
Red Hat JBoss Fuse Service Works 6.0 RHSA-2014:1995 2014-12-15
Red Hat JBoss Operations Network 3.3 RHSA-2014:1904 2014-11-25
Red Hat JBoss Data Grid 6.2 RHSA-2014:0029 2014-01-15
Red Hat JBoss A-MQ 6.1 RHSA-2014:0401 2014-04-14
Red Hat JBoss Fuse 6.1 RHSA-2014:0400 2014-04-14
Red Hat JBoss BRMS 6.0 RHSA-2014:1290 2014-09-23
Red Hat JBoss Data Virtualization 6.0 RHSA-2015:0034 2015-01-12
RHOSE Client 1.2 (activemq) RHSA-2014:0254 2014-03-05
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server RHSA-2013:1786 2013-12-04


This issue was discovered by Florian Weimer of the Red Hat Product Security Team.