CVE:CVE-2011-4605
CNNVD:CNNVD-201207-428
Red Hat JBoss Enterprise Application Platform（JBoss Eap）是美国红帽（Red Hat）公司的一个基于订阅的/基于 Java Ee 的开源应用服务器运行时平台。用于构建，部署和托管由 Red Hat 开发和维护的高度事务性 Java 应用程序和服务。
Red Hat JBoss Enterprise Application Platform 4.3.0 CP10和5.1.2版本，Web Platform 5.1.2版本，SOA Platform 4.2.0.CP05和4.3.0.CP05版本，Portal Platform 4.3 CP07和5.2.2之前的5.2.x版本，BRMS Platform 5.3.0之前的版本中的(1)JNDI服务(2)HA-JNDI服务以及(3)HAJNDIFactory调用器存在漏洞，该漏洞源于程序没有正确限制写入访问权限。远程攻击者可通过未明向量利用该漏洞添加删除或修改JNDI树中的项目。
solution:Upgrade redhat jboss_enterprise_application_platform to a higher version than 4.3.0:cp10,5.1.2,and avoid the version 4.3.0:cp10,5.1.2; Upgrade redhat jboss_enterprise_brms_platform to a higher version than 5.2.0,and avoid the version (,5.2.0]; Upgrade redhat jboss_enterprise_portal_platform to a higher version than 4.3.0:cp07,5.2.0,5.2.1,and avoid the version 4.3.0:cp07,5.2.0,5.2.1; Upgrade redhat jboss_enterprise_soa_platform to a higher version than 4.2.0:cp05,4.3.0:cp05,and avoid the version 4.2.0:cp05,4.3.0:cp05; Upgrade redhat jboss_enterprise_web_platform to a higher version than 5.1.2,and avoid the version 5.1.2