Homepage

Incorrect Permission Assignment for Critical Resource Affecting jboss-as-server package, versions <0:7.5.14-2.Final_redhat_2.1.ep6.el7

Severity

 Recommended
0.0
high
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.06% (29th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL7-JBOSSASSERVER-3582434
  • published26 Mar 2023
  • disclosed10 Oct 2016
Report a new vulnerability Found a mistake?

Introduced: 10 Oct 2016

CVE-2016-8657  (opens in a new tab)
CWE-732  (opens in a new tab)

How to fix?

Upgrade RHEL:7 jboss-as-server to version 0:7.5.14-2.Final_redhat_2.1.ep6.el7 or higher.
This issue was patched in RHSA-2017:0828.

NVD Description

Note: Versions mentioned in the description apply only to the upstream jboss-as-server package and not the jboss-as-server package as distributed by RHEL. See How to fix? for RHEL:7 relevant fixed versions and status.

It was discovered that EAP packages in certain versions of Red Hat Enterprise Linux use incorrect permissions for /etc/sysconfig/jbossas configuration files. The file is writable to jboss group (root:jboss, 664). On systems using classic /etc/init.d init scripts (i.e. on Red Hat Enterprise Linux 6 and earlier), the file is sourced by the jboss init script and its content executed with root privileges when jboss service is started, stopped, or restarted.