Secunia

Oliver Karow has reported a vulnerability in JBoss, which can be exploited by malicious users to disclose sensitive information, manipulate data, or potentially to compromise a vulnerable system.

The vulnerability is caused due to an input validation error the "setBaseDir()" method in org.jboss.console.manager.DeploymentFileRepository. This can be exploited to read, write, or delete arbitrary files, and potentially to execute arbitrary code with privileges of the JBoss user.

The vulnerability is reported in JBoss Web Server 1.0.0.GA. Other versions may also be affected.

Reportedly this vulnerability also affects the following versions of JBoss Application Server:
* JBossAS-4.0.4.GA
* JBossAS-4.0.3 SP1
* JBossAS-4.0.2 Final
* JBossAS-3.2.7 Final
* JBossAS-4.0.3 Final
* JBossAS-4.0.1 SP1
* JBossAS-4.0.1 Final
* JBossAS-4.0.0 Final
* JBossAS-3.2.8.SP1
* JBossAS-3.2.8 Final
* JBossAS-3.2.6 Final
* JBossAS-3.2.5 Final

Solution
Apply patch:
Further details available in Customer Area

Provided and/or discovered by
Oliver Karow

Original Advisory
Symantec:
http://www.symantec.com/enterprise/research/SYMSA-2006-011.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area