Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 28 Mar 2014 10:02:29 -0400 (EDT)
From: "Steven M. Christey" <>
Subject: JBoss EJBInvokerServlet/JMXInvokerServlet confusion

There are several CVEs related to the lack of authentication for JBoss
invoker servlets, but there's a bit of confusion and a likely

CVE-2012-0874 is associated with various Red Hat advisories that
mention JMXInvokerHAServlet and EJBInvokerHAServlet - with "HA" in the
name - in JBoss.

The description for CVE-2013-4810 is currently focused on HP products,
but it mentions EJBInvokerServlet and JMXInvokerServlet (different
servlets without "HA" in the name).  Through the associated ZDI
advisory, this issue is associated with some exploit(s) authored by
Andrea Micalizzi (rgod), who reported the issue in various products
that utilize JBoss.  In addition, - "Does CVE-2013-4810
affect Red Hat JBoss products?" - clarifies that these servlets are
"exposed without authentication on older, unsupported community
releases of JBoss AS (WildFly) 4.x and 5.x."

CVE-2013-4810 is used heavily with references to ZDI-13-229.

The openness of JMXInvokerServlet is covered in a 2011-era disclosure
in, although
EJBInvokerServlet is not mentioned then.

The key question is whether CVE-2013-4810 is a duplicate of an
existing CVE that covers EJBInvokerServlet and JMXInvokerServlet, and
if so, which CVE is it a duplicate of.

It is not a duplicate of CVE-2012-0874, since that deals with the
exposure of different servlets - the "HA" servlets - so is effectively
a variant of the original issue.

CVE-2007-1036 is heavily used.  Although it does not mention 
EJBInvokerServlet or JMXInvokerServlet, it is related to insecure JBoss 
configuration.  None of the commonly-associated references mention 
EJBInvokerServlet and JMXInvokerServlet, either.  If we can clearly link 
CVE-2007-1036 with those servlets, then it becomes possible to reject 
CVE-2013-4810 as a duplicate.

Original links such as are now gone,
which is unfortunate because this is a "bridge reference" that is
included in both CVE-2007-1036 and Red Hat's "Does CVE-2013-4810
affect Red Hat JBoss products?" article. doesn't name the

There is, at least, a Metasploit module that maps to CVE-2007-1036 and
calls JMXInvokerServlet:

There's still a question of EJBInvokerServlet - I haven't seen it
mentioned in conjunction with CVE-2007-1036 yet.

Also, it appears that there are mentions of other vectors besides
servlets, e.g.

Red Hat, can you confirm that the scope of CVE-2007-1036 is the lack
of authentication for both JMXInvokerServlet and EJBInvokerServlet?

- Steve

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.