Red Hat JBoss Flaw in Drools Workbench Component Lets Remote Authenticated Users Traverse the Directory to View Files on the Target System
SecurityTracker Alert ID: 1037406|
SecurityTracker URL: http://securitytracker.com/id/1037406
(Links to External Site)
Date: Dec 8 2016
Disclosure of system information, Disclosure of user information|
Fix Available: Yes Vendor Confirmed: Yes |
A vulnerability was reported in Red Hat JBoss. A remote authenticated user can view files on the target system.|
The software does not properly validate user-supplied input. A remote user can supply a specially crafted request to bypass directory restrictions and view arbitrary files on target system.
The vulnerability resides in the Drools Workbench component.
Jonas Bauters (NVISO) reported this vulnerability.
A remote authenticated user can view arbitrary files on the target system.|
Red Hat has issued a fix.|
The Red Hat advisories are available at:
Vendor URL: rhn.redhat.com/errata/RHSA-2016-2937.html (Links to External Site)
Input validation error|
|Underlying OS: Linux (Red Hat Enterprise)|
Source Message Contents
Subject: [RHSA-2016:2937-01] Moderate: Red Hat JBoss BPM Suite security update|
-----BEGIN PGP SIGNED MESSAGE-----
Red Hat Security Advisory
Synopsis: Moderate: Red Hat JBoss BPM Suite security update
Advisory ID: RHSA-2016:2937-01
Product: Red Hat JBoss BPM Suite
Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2937.html
Issue date: 2016-12-08
CVE Names: CVE-2016-7041
An update is now available for Red Hat JBoss BPM Suite.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
This release of Red Hat JBoss BPM Suite 6.3.4 serves as a replacement for
Red Hat JBoss BPM Suite 6.3.3, and includes bug fixes and enhancements,
which are documented in the Release Notes of the patch linked to in the
* Drools Workbench contains the path traversal vulnerability. The
vulnerability allows a remote, authenticated attacker to bypass the
directory restrictions and retrieve arbitrary files from the affected host.
Red Hat would like to thank Jonas Bauters (NVISO) for reporting this issue.
Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
It is recommended to halt the server by stopping the JBoss Application
Server process before installing this update; after installing the update,
restart the server by starting the JBoss Application Server process.
The References section of this erratum contains a download link (you must
log in to download the update).
4. Bugs fixed (https://bugzilla.redhat.com/):
1375757 - CVE-2016-7041 Drools Workbench: Path traversal vulnerability
The Red Hat security contact is <firstname.lastname@example.org>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
-----END PGP SIGNATURE-----
RHSA-announce mailing list