VRDA Feed by JPCERT/CC
  Vulnerability Response Decision Assistance Feed : Information for vulnerability impact analysis
[ about VRDA Feed | JPCERT/CC



 
Vulnerability Analysis Result (Revision No : 1) [ Download XML
CVE-2010-4265
jboss_enterprise_application_platform, jboss_enterprise_web_platform, jboss_remoting: The org.jboss.remoting.transport.bisocket.BisocketS...
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4265

Original

The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 through 4.3.0.CP09 allows remote attackers to cause a denial of service (daemon outage) by establishing a bisocket control connection TCP session, and then not sending any application data, related to a missing CVE-2010-3862 patch. NOTE: this can ...

Translation   (Show)





About This Analysis Information
Analysis Information Provider:
NIST NVD
First Published:
2010-12-30
Source Information Category:
Advisory, Alert
Last Updated:
2010-12-31




Affected Product Tags
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0:cp01
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0:cp02
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0:cp03
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0:cp04
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0:cp05
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0:cp06
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0:cp07
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0:cp08
cpe:/a:redhat:jboss_enterprise_application_platform:4.3.0:cp09
cpe:/a:redhat:jboss_enterprise_application_platform:5.1.0
cpe:/a:redhat:jboss_enterprise_web_platform:5.1.0
cpe:/a:redhat:jboss_remoting:2.2.0
cpe:/a:redhat:jboss_remoting:2.2.2:sp10
cpe:/a:redhat:jboss_remoting:2.2.2:sp11
cpe:/a:redhat:jboss_remoting:2.2.2:sp2
cpe:/a:redhat:jboss_remoting:2.2.2:sp4
cpe:/a:redhat:jboss_remoting:2.2.2:sp7
cpe:/a:redhat:jboss_remoting:2.2.2:sp8
cpe:/a:redhat:jboss_remoting:2.2.3
cpe:/a:redhat:jboss_remoting:2.2.3:sp1
cpe:/a:redhat:jboss_remoting:2.2.3:sp2
cpe:/a:redhat:jboss_remoting:2.2.3:sp3
 


Vulnerability Analysis Results
[Access Vector]  [?]
Undefined [?]

Local [?]
Adjacent Network [?]
X Network [?]

[Access Complexit]  [?]
Undefined [?]

X High [?]
Medium [?]
Low [?]

[Authentication]  [?]
Undefined [?]

Multiple [?]
Single [?]
X None [?]

[Confidentiality Impact]  [?]
Undefined [?]

X None [?]
Partial [?]
Complete [?]

[Integrity Impact]  [?]
Undefined [?]

X None [?]
Partial [?]
Complete [?]

[Availability Impact]  [?]
Undefined [?]

None [?]
X Partial [?]
Complete [?]

Alternatives




References
CONFIRM https://issues.jboss.org/browse/JBREM-1261




CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=660623




MISC https://issues.jboss.org/browse/JBPAPP-5253




REDHAT RHSA-2010:0965




REDHAT RHSA-2010:0964




SECTRACK 1024840




Vulnerability Type Design Error (NVD-CWE-DesignError)





Copyright © 2010 JPCERT/CC All Rights Reserved.