CVE Vulnerabilities

CVE-2019-3805

Improper Privilege Management

Published: May 03, 2019 | Modified: Oct 16, 2020
CVSS 3.x
4.7
MEDIUM
Source:
NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
4.7 MEDIUM
AV:L/AC:M/Au:N/C:N/I:N/A:C
RedHat/V2
RedHat/V3
5.5 MODERATE
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Ubuntu

A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate arbitrary processes on the system. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any process as root.

Weakness

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Software

Name Vendor Start Version End Version
Jboss_enterprise_application_platform Redhat 6.0.0 (including) 6.0.0 (including)
Jboss_enterprise_application_platform Redhat 7.0.0 (including) 7.0.0 (including)
Wildfly Redhat * 16.0.0 (including)
Red Hat Data Grid 7.3.3 RedHat wildfly *
Red Hat Fuse 7.4.0 RedHat wildfly *
Red Hat JBoss EAP 7.2 RedHat wildfly *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-activemq-artemis-0:2.6.3-5.redhat_00020.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-apache-commons-lang-0:3.8.0-1.redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-apache-cxf-0:3.2.7-1.redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-apache-cxf-xjc-utils-0:3.2.3-2.redhat_00002.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-artemis-native-0:2.6.3-15.redhat_00020.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-byte-buddy-0:1.9.5-1.redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-dom4j-0:2.1.1-2.redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-elytron-web-0:1.2.4-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-hibernate-0:5.3.9-2.Final_redhat_00002.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-httpcomponents-asyncclient-0:4.1.4-1.redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-infinispan-0:9.3.6-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-ironjacamar-0:1.4.15-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-jackson-annotations-0:2.9.8-2.redhat_00004.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-jackson-core-0:2.9.8-2.redhat_00004.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-jackson-databind-0:2.9.8-2.redhat_00004.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-jackson-jaxrs-providers-0:2.9.8-2.redhat_00004.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-jackson-modules-base-0:2.9.8-1.redhat_00004.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-jackson-modules-java8-0:2.9.8-1.redhat_00004.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-jberet-0:1.3.2-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-jboss-ejb-client-0:4.0.15-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-jboss-el-api_3.0_spec-0:1.0.13-2.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-jboss-genericjms-0:2.0.1-2.Final_redhat_00002.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-jboss-logmanager-0:2.1.7-3.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-jboss-remoting-jmx-0:3.0.1-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-jboss-security-negotiation-0:3.0.5-2.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-jboss-server-migration-0:1.3.0-7.Final_redhat_00004.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-narayana-0:5.9.1-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-picketlink-bindings-0:2.5.5-16.SP12_redhat_4.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-picketlink-federation-0:2.5.5-16.SP12_redhat_4.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-resteasy-0:3.6.1-4.SP3_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-sun-istack-commons-0:3.0.7-2.redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-undertow-0:2.0.19-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-undertow-jastow-0:2.0.7-2.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-wildfly-0:7.2.1-6.GA_redhat_00004.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-wildfly-elytron-0:1.6.2-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-wildfly-elytron-tool-0:1.4.1-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-wildfly-http-client-0:1.0.13-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-wildfly-transaction-client-0:1.1.3-1.Final_redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 RedHat eap7-yasson-0:1.0.2-1.redhat_00001.1.el6eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-activemq-artemis-0:2.6.3-5.redhat_00020.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-apache-commons-lang-0:3.8.0-1.redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-apache-cxf-0:3.2.7-1.redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-apache-cxf-xjc-utils-0:3.2.3-2.redhat_00002.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-artemis-native-0:2.6.3-15.redhat_00020.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-byte-buddy-0:1.9.5-1.redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-dom4j-0:2.1.1-2.redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-elytron-web-0:1.2.4-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-hibernate-0:5.3.9-2.Final_redhat_00002.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-httpcomponents-asyncclient-0:4.1.4-1.redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-infinispan-0:9.3.6-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-ironjacamar-0:1.4.15-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-jackson-annotations-0:2.9.8-2.redhat_00004.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-jackson-core-0:2.9.8-2.redhat_00004.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-jackson-databind-0:2.9.8-2.redhat_00004.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-jackson-jaxrs-providers-0:2.9.8-2.redhat_00004.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-jackson-modules-base-0:2.9.8-1.redhat_00004.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-jackson-modules-java8-0:2.9.8-1.redhat_00004.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-jberet-0:1.3.2-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-jboss-ejb-client-0:4.0.15-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-jboss-el-api_3.0_spec-0:1.0.13-2.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-jboss-genericjms-0:2.0.1-2.Final_redhat_00002.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-jboss-logmanager-0:2.1.7-3.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-jboss-remoting-jmx-0:3.0.1-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-jboss-security-negotiation-0:3.0.5-2.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-jboss-server-migration-0:1.3.0-7.Final_redhat_00004.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-narayana-0:5.9.1-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-picketlink-bindings-0:2.5.5-16.SP12_redhat_4.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-picketlink-federation-0:2.5.5-16.SP12_redhat_4.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-resteasy-0:3.6.1-4.SP3_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-sun-istack-commons-0:3.0.7-2.redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-undertow-0:2.0.19-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-undertow-jastow-0:2.0.7-2.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-wildfly-0:7.2.1-6.GA_redhat_00004.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-wildfly-elytron-0:1.6.2-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-wildfly-elytron-tool-0:1.4.1-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-wildfly-http-client-0:1.0.13-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-wildfly-transaction-client-0:1.1.3-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 RedHat eap7-yasson-0:1.0.2-1.redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform Continuous Delivery RedHat wildfly *
Red Hat Single Sign-On 7.3.1 zip RedHat *

Potential Mitigations

References