Lucene search

RedhatCVE-2017-12189

HistoryJan 10, 2018 - 7:29 p.m.

CVE-2017-12189

2018-01-1019:29:00

CWE-282

redhat

web.nvd.nist.gov

cve-2017-12189

red hat

jboss

enterprise application platform

local privilege escalation

incomplete fix

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

10.1%

JSON

It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handling which could result in local privilege escalation. This issue is a result of an incomplete fix for CVE-2016-8656.

Affected configurations

Nvd

Vulners

Node

redhatjboss_enterprise_application_platformMatch7.0

Node

redhatenterprise_linuxMatch6.0

redhatenterprise_linuxMatch7.0

VendorProductVersionCPE
redhatjboss_enterprise_application_platform7.0cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*
redhatenterprise_linux6.0cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
redhatenterprise_linux7.0cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	jboss_enterprise_application_platform	7.0	cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:::::::*
redhat	enterprise_linux	6.0	cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*
redhat	enterprise_linux	7.0	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*

CNA Affected

[
  {
    "product": "Red Hat JBoss Enterprise Application Platform",
    "vendor": "Red Hat, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "7.0.7.GA"
      }
    ]
  }
]

References

www.securityfocus.com/bid/102407

access.redhat.com/errata/RHSA-2018:0002

access.redhat.com/errata/RHSA-2018:0003

access.redhat.com/errata/RHSA-2018:0004

access.redhat.com/errata/RHSA-2018:0005

bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12189

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

10.1%

JSON

Related for CVE-2017-12189