CVE-2012-3431
The MITRE CVE dictionary describes this issue as:
The Teiid Java Database Connectivity (JDBC) socket, as used in JBoss Enterprise Data Services Platform before 5.3.0, does not encrypt login messages by default contrary to documentation and specification, which allows remote attackers to obtain login credentials via a man-in-the-middle (MITM) attack.
Find out more about CVE-2012-3431 from the MITRE CVE dictionary dictionary and NIST NVD.
CVSS v2 metrics
| Base Score | 3.3 |
|---|---|
| Base Metrics | AV:A/AC:L/Au:N/C:P/I:N/A:N |
| Access Vector | Adjacent Network |
| Access Complexity | Low |
| Authentication | None |
| Confidentiality Impact | Partial |
| Integrity Impact | None |
| Availability Impact | None |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| JBoss Enterprise Data Services Platform 5.3 | RHSA-2012:1301 | 2012-09-20 |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat JBoss Enterprise SOA Platform 5 | EDS | Will not fix |
Acknowledgements
This issue was discovered by Steven Hawkins of Red Hat.CVE description copyright © 2017, The MITRE Corporation