JBoss Enterprise Application Platform privilege escalation vulnerability CVE-2016-8656 and CVE-2016-8657

Updated 31 Jul 2017

Overview

The privilege escalation issue was originally reported against tomcat init scripts (CVE-2016-6325 and CVE-2016-1240 ) and as result of further research was found that it is also applicable to Red Hat JBoss Enterprise Application Platform.

The CVE-2016-8656 addresses issue with the jbossas init script that performs unsafe file handling, which could result in local privilege escalation.The log files can be symbolically linked to important system files and thus allowing someone with jboss group to gain privilege escalation.This issue affects Red Hat JBoss Enterprise Application Platform 5,6 and 7.

The CVE-2016-8657 addresses the issue with incorrect permissions for /etc/sysconfig/jbossas configuration files with certain Red Hat Enterprise Linux versions.A user with jboss group membership can access configuration files and gain a escalation.This issue affects Red Hat JBoss Enterprise Application Platform 5 and 6.