Does CVE-2014-3518 affect JBoss products?

Resolution

• By default, all supported Red Hat JBoss 5.x products are not affected. These products will only be vulnerable if JMX remoting is enabled by manually deploying jmx-remoting.sar from thejboss-as/docs/examples directory. Unsupported community releases of JBoss Application Server 5.x are affected by default. All users of the standalone JBoss Remoting project are also affected.

• If your server is affected, you should undeploy jmx-remoting.sar if JMX remoting is not required by your applications. If it is required, you should secure JMX remoting.

Configuring with password access files security

# Enable the jconsole agent locally
JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote"

# Tell JBossAS to use the platform MBean server
JAVA_OPTS="$JAVA_OPTS -Djboss.platform.mbeanserver"

# Make the platform MBean server able to work with JBossAS MBeans
JAVA_OPTS="$JAVA_OPTS -Djavax.management.builder.initial=org.jboss.system.server.jmx.MBeanServerBuilderImpl"

# Set the port
JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote.port=19988"

# Enable security using user/pass in properties file
JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=true -Dcom.sun.management.jmxremote.password.file=$JBOSS_HOME/bin/jmxremote.password -Dcom.sun.management.jmxremote.access.file=$JBOSS_HOME/bin/jmxremote.access"

• Unless it is set, com.sun.management.jmxremote.access.file defaults to $JAVA_HOME/jre/lib/management/jmxremote.access and com.sun.management.jmxremote.password.file defaults to $JAVA_HOME/jre/lib/management/jmxremote.password

• The usernames and passwords are defined injmxremote.password (there is a template in $JAVA_HOME/jre/lib/management/jmxremote.password.template)

• For example, adding an admin user with a password of redhat, and a user named monitor with password jboss, would be like:

admin redhat
monitor jboss

• The users's roles are defined in jmxremote.access, there are two roles readonly and readwrite, so we could allow user monitor to only read mbeans and allow user admin to read and write by:

admin readwrite
monitor readonly

• Then test the service connectivity: jmx:rmi:///jndi/rmi://127.0.0.1:19988/jmxrmi

import javax.management.MBeanServerConnection;
import javax.management.remote.JMXServiceURL;
import javax.management.remote.JMXConnector;
import javax.management.remote.JMXConnectorFactory;
import java.util.Map;
import java.util.HashMap;

    // this is the port that you configure in $JBOSS_HOME/bin/run.conf
    int portNum = 19988;

    // the hostName should be set to the ip / hostname that the JBoss you want to call is listening upon
    String serviceURL = "service:jmx:rmi:///jndi/rmi://" + hostName + ":" + portNum +  "/jmxrmi";

    // Create a JMXServiceURL
    JMXServiceURL u = new JMXServiceURL(serviceURL);

    // If you have authentication enabled, configure the username / password credentials
    Map environment = new HashMap(1);
    String[] credentials = {user, pass};
    environment.put(JMXConnector.CREDENTIALS, credentials);

    // connect to the JMXServiceURL using the given environment properties (If you have authentication disabled, you can remove the environment) 
    JMXConnector c = JMXConnectorFactory.connect(u, environment);

    // Get the MBeanServer connection which has the API to get and call the MBeans
    MBeanServerConnection server = c.getMBeanServerConnection();

    // Test by getting the number of mbeans
    System.out.println("MBean Count: " + server.getMBeanCount());

    // Cleanup 
    if(c != null) {
       c.close();
    }