Unauthenticated JNDI Lookup Hijack in EAP IIOP Listener

Executive Summary

This vulnerability is in EAP's IIOP listener's NameService, which accepts bind operations without authentication. An attacker can hijack JNDI lookups by binding malicious ORBs, enabling MITM or DoS attacks on further invocations.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if port 3528 is open and listening on your system, as this is the default port for the IIOP NameService. Use commands like 'netstat -tulnp | grep 3528' or 'ss -tulnp | grep 3528' on Linux. If the port is open and the service is running, verify if authentication is enforced for bind operations.

Useful 0 Not Useful 0

Impact Analysis

An attacker could intercept or alter communications between clients and services (MITM) or disrupt services entirely (DoS). This requires network access but no user interaction, making it a serious threat to confidentiality and integrity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's confidentiality requirements and HIPAA's safeguards for protected health information. Compliance may be compromised if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately disable the IIOP NameService if not required. If the service is necessary, restrict network access to port 3528 using firewalls. Apply vendor patches or updates for Red Hat JBoss EAP or WildFly IIOP OpenJDK as soon as they become available. Monitor for unauthorized bind or rebind operations on the NameService.

Useful 0 Not Useful 0