This morning i received from the auditors a scanner result for our jboss server and we need to solve three important issues, but honestly i was googling for a while and nothing found. if any one know or have any clue how to solve, i will appreciate. We are running jboss 5.0.1 on (windows 2003 x64)
.- JBoss HttpAdaptor JMXInvokerServlet is Accessible to Unauthenticated Remote Users .- JBoss EJBInvokerServlet is Accessible to Unauthenticated Remote Users. .- TLS Protocol Session Renegotiation Security Vulnerability
Thanks in advance.
If you’ve left your configuration as is, the above is available you have a problem.
The reason you don’t want to do it is pretty clear, it allows anyone to invoke any servlet they want that is on your system.
The short answer is, find it in your web.xml and disable it.
A Tomcat Specific article about the why:
Leave a comment
- Is there a way for administrators to disable users from installing Firefox extensions?
- Is there research material on NTP accuracy available?
- How to create a limited “domain admin” that does not have access to domain controllers?
- Can Windows RDC admin users be immune from being kicked?
- Domain Administrators account policy (After PCI audit)