VRDA Feed by JPCERT/CC
  Vulnerability Response Decision Assistance Feed : Information for vulnerability impact analysis
[ about VRDA Feed | JPCERT/CC



 
Vulnerability Analysis Result (Revision No : 2) [ Download XML
CVE-2010-3862
jboss_enterprise_application_platform, jboss_enterprise_web_platform, jboss_remoting: The org.jboss.remoting.transport.bisocket.BisocketS...
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-3862

Original

The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 through 4.3.0.CP09, and 5.1.0; and JBoss Enterprise Web Platform (aka JBEWP) 5.1.0; allows remote attackers to cause a denial of service (daemon outage) by establishing a bisocket control connection TCP session, and then not sending any application...

Translation   (Show)





About This Analysis Information
Analysis Information Provider:
NIST NVD
First Published:
2010-12-30
Source Information Category:
Advisory, Alert
Last Updated:
2010-12-31




Affected Product Tags
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0:cp01
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0:cp02
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0:cp03
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0:cp04
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0:cp05
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0:cp06
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0:cp07
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0:cp08
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0:cp09
cpe:/a:redhat:jboss_enterprise_application_platform:5.1.0
cpe:/a:redhat:jboss_enterprise_web_platform:5.1.0
cpe:/a:redhat:jboss_remoting:2.2.0
cpe:/a:redhat:jboss_remoting:2.2.2:sp10
cpe:/a:redhat:jboss_remoting:2.2.2:sp11
cpe:/a:redhat:jboss_remoting:2.2.2:sp2
cpe:/a:redhat:jboss_remoting:2.2.2:sp4
cpe:/a:redhat:jboss_remoting:2.2.2:sp7
cpe:/a:redhat:jboss_remoting:2.2.2:sp8
cpe:/a:redhat:jboss_remoting:2.2.3
cpe:/a:redhat:jboss_remoting:2.2.3:sp1
cpe:/a:redhat:jboss_remoting:2.2.3:sp2
cpe:/a:redhat:jboss_remoting:2.2.3:sp3
 


Vulnerability Analysis Results
[Access Vector]  [?]
Undefined [?]

Local [?]
Adjacent Network [?]
X Network [?]

[Access Complexit]  [?]
Undefined [?]

X High [?]
Medium [?]
Low [?]

[Authentication]  [?]
Undefined [?]

Multiple [?]
Single [?]
X None [?]

[Confidentiality Impact]  [?]
Undefined [?]

X None [?]
Partial [?]
Complete [?]

[Integrity Impact]  [?]
Undefined [?]

X None [?]
Partial [?]
Complete [?]

[Availability Impact]  [?]
Undefined [?]

None [?]
X Partial [?]
Complete [?]

Alternatives




References
CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=641389




CONFIRM https://issues.jboss.org/browse/JBREM-1261




MISC https://issues.jboss.org/browse/JBPAPP-5253




REDHAT RHSA-2010:0963




REDHAT RHSA-2010:0962




REDHAT RHSA-2010:0961




REDHAT RHSA-2010:0960




REDHAT RHSA-2010:0959




REDHAT RHSA-2010:0939




REDHAT RHSA-2010:0938




REDHAT RHSA-2010:0937




SECTRACK 1024813




Vulnerability Type Input Validation (CWE-20)





Copyright © 2010 JPCERT/CC All Rights Reserved.