CVE-2015-1849: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.9
Published: 2017-09-19T17:29Z
Repository: https://github.com/wildfly-security/jboss-negotiation
Language: Other
Files changed: .gitignore, jboss-negotiation-extras/src/main/java/org/jboss/security/negotiation/AdvancedLdapLoginModule.java
Commit date: 2015-03-26 12:41:20 -0300
Commit message: SECURITY-877

Diff: diff --git a/.gitignore b/.gitignore
index 4322165..1e15488 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,7 +4,9 @@ jboss-negotiation-common/target
 jboss-negotiation-extras/target
 jboss-negotiation-net/target
 jboss-negotiation-ntlm/target
 jboss-negotiation-spnego/target
 jboss-negotiation-toolkit/target
+jboss-negotiation-toolkit/.project
+jboss-negotiation-toolkit/.classpath
 *.iml
 *~
diff --git a/jboss-negotiation-extras/src/main/java/org/jboss/security/negotiation/AdvancedLdapLoginModule.java b/jboss-negotiation-extras/src/main/java/org/jboss/security/negotiation/AdvancedLdapLoginModule.java
index fa173e2..74d6174 100644
--- a/jboss-negotiation-extras/src/main/java/org/jboss/security/negotiation/AdvancedLdapLoginModule.java
+++ b/jboss-negotiation-extras/src/main/java/org/jboss/security/negotiation/AdvancedLdapLoginModule.java
@@ -906,15 +906,18 @@ public class AdvancedLdapLoginModule extends CommonLoginModule
       {
          Properties tmp = new Properties();
          tmp.putAll(env);
          String credentials = tmp.getProperty(Context.SECURITY_CREDENTIALS);
          String bindCredential = tmp.getProperty(BIND_CREDENTIAL);
-         if (credentials != null && credentials.length() > 0)
-            tmp.setProperty(Context.SECURITY_CREDENTIALS, "***");
          
-         if (bindCredential != null && bindCredential.length() > 0)
-             tmp.setProperty(BIND_CREDENTIAL, "***");
+         if (credentials != null && credentials.length() > 0) {
+        	 tmp.setProperty(Context.SECURITY_CREDENTIALS, "***");
+         }
+            
+         if (bindCredential != null && bindCredential.length() > 0) {
+        	 tmp.setProperty(BIND_CREDENTIAL, "***");
+         }
          
          log.trace("Logging into LDAP server, env=" + tmp.toString());
       }
    }
 
diff --git a/jboss-negotiation-toolkit/.classpath b/jboss-negotiation-toolkit/.classpath
deleted file mode 100644
index c13ff1d..0000000
--- a/jboss-negotiation-toolkit/.classpath
+++ /dev/null
@@ -1,28 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<classpath>
-	<classpathentry kind="src" output="target/classes" path="src/main/java">
-		<attributes>
-			<attribute name="optional" value="true"/>
-			<attribute name="maven.pomderived" value="true"/>
-		</attributes>
-	</classpathentry>
-	<classpathentry kind="con" path="org.maven.ide.eclipse.MAVEN2_CLASSPATH_CONTAINER"/>
-	<classpathentry kind="src" output="target/test-classes" path="src/tests/java">
-		<attributes>
-			<attribute name="optional" value="true"/>
-			<attribute name="maven.pomderived" value="true"/>
-		</attributes>
-	</classpathentry>
-	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/J2SE-1.5">
-		<attributes>
-			<attribute name="maven.pomderived" value="true"/>
-		</attributes>
-	</classpathentry>
-	<classpathentry kind="con" path="org.eclipse.m2e.MAVEN2_CLASSPATH_CONTAINER">
-		<attributes>
-			<attribute name="maven.pomderived" value="true"/>
-			<attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
-		</attributes>
-	</classpathentry>
-	<classpathentry kind="output" path="target/classes"/>
-</classpath>
diff --git a/jboss-negotiation-toolkit/.project b/jboss-negotiation-toolkit/.project
deleted file mode 100644
index 70510d4..0000000
--- a/jboss-negotiation-toolkit/.project
+++ /dev/null
@@ -1,52 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<projectDescription>
-	<name>jboss-negotiation-toolkit</name>
-	<comment>JBoss Negotiation Toolkit</comment>
-	<projects>
-		<project>jboss-negotiation</project>
-		<project>jboss-negotiation-common</project>
-		<project>jboss-negotiation-ntlm</project>
-		<project>jboss-negotiation-spnego</project>
-	</projects>
-	<buildSpec>
-		<buildCommand>
-			<name>org.eclipse.wst.jsdt.core.javascriptValidator</name>
-			<arguments>
-			</arguments>
-		</buildCommand>
-		<buildCommand>
-			<name>org.eclipse.wst.common.project.facet.core.builder</name>
-			<arguments>
-			</arguments>
-		</buildCommand>
-		<buildCommand>
-			<name>org.eclipse.jdt.core.javabuilder</name>
-			<arguments>
-			</arguments>
-		</buildCommand>
-		<buildCommand>
-			<name>org.maven.ide.eclipse.maven2Builder</name>
-			<arguments>
-			</arguments>
-		</buildCommand>
-		<buildCommand>
-			<name>org.eclipse.m2e.core.maven2Builder</name>
-			<arguments>
-			</arguments>
-		</buildCommand>
-		<buildCommand>
-			<name>org.eclipse.wst.validation.validationbuilder</name>
-			<arguments>
-			</arguments>
-		</buildCommand>
-	</buildSpec>
-	<natures>
-		<nature>org.eclipse.jem.workbench.JavaEMFNature</nature>
-		<nature>org.eclipse.wst.common.modulecore.ModuleCoreNature</nature>
-		<nature>org.eclipse.m2e.core.maven2Nature</nature>
-		<nature>org.maven.ide.eclipse.maven2Nature</nature>
-		<nature>org.eclipse.jdt.core.javanature</nature>
-		<nature>org.eclipse.wst.common.project.facet.core.nature</nature>
-		<nature>org.eclipse.wst.jsdt.core.jsNature</nature>
-	</natures>
-</projectDescription>

Vulnerable code:          if (credentials != null && credentials.length() > 0)
            tmp.setProperty(Context.SECURITY_CREDENTIALS, "***");
         if (bindCredential != null && bindCredential.length() > 0)
             tmp.setProperty(BIND_CREDENTIAL, "***");
<?xml version="1.0" encoding="UTF-8"?>
<classpath>
	<classpathentry kind="src" output="target/classes" path="src/main/java">
		<attributes>
			<attribute name="optional" value="true"/>
			<attribute name="maven.pomderived" value="true"/>
		</attributes>
	</classpathentry>
	<classpathentry kind="con" path="org.maven.ide.eclipse.MAVEN2_CLASSPATH_CONTAINER"/>
	<classpathentry kind="src" output="target/test-classes" path="src/tests/java">
		<attributes>
			<attribute name="optional" value="true"/>
			<attribute name="maven.pomderived" value="true"/>
		</attributes>
	</classpathentry>
	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/J2SE-1.5">
		<attributes>
			<attribute name="maven.pomderived" value="true"/>
		</attributes>
	</classpathentry>
	<classpathentry kind="con" path="org.eclipse.m2e.MAVEN2_CLASSPATH_CONTAINER">
		<attributes>
			<attribute name="maven.pomderived" value="true"/>
			<attribute name="org.eclipse.jst.component.dependency" value="/WEB-INF/lib"/>
		</attributes>
	</classpathentry>
	<classpathentry kind="output" path="target/classes"/>
</classpath>
<?xml version="1.0" encoding="UTF-8"?>
<projectDescription>
	<name>jboss-negotiation-toolkit</name>
	<comment>JBoss Negotiation Toolkit</comment>
	<projects>
		<project>jboss-negotiation</project>
		<project>jboss-negotiation-common</project>
		<project>jboss-negotiation-ntlm</project>
		<project>jboss-negotiation-spnego</project>
	</projects>
	<buildSpec>
		<buildCommand>
			<name>org.eclipse.wst.jsdt.core.javascriptValidator</name>
			<arguments>
			</arguments>
		</buildCommand>
		<buildCommand>
			<name>org.eclipse.wst.common.project.facet.core.builder</name>
			<arguments>
			</arguments>
		</buildCommand>
		<buildCommand>
			<name>org.eclipse.jdt.core.javabuilder</name>
			<arguments>
			</arguments>
		</buildCommand>
		<buildCommand>
			<name>org.maven.ide.eclipse.maven2Builder</name>
			<arguments>
			</arguments>
		</buildCommand>
		<buildCommand>
			<name>org.eclipse.m2e.core.maven2Builder</name>
			<arguments>
			</arguments>
		</buildCommand>
		<buildCommand>
			<name>org.eclipse.wst.validation.validationbuilder</name>
			<arguments>
			</arguments>
		</buildCommand>
	</buildSpec>
	<natures>
		<nature>org.eclipse.jem.workbench.JavaEMFNature</nature>
		<nature>org.eclipse.wst.common.modulecore.ModuleCoreNature</nature>
		<nature>org.eclipse.m2e.core.maven2Nature</nature>
		<nature>org.maven.ide.eclipse.maven2Nature</nature>
		<nature>org.eclipse.jdt.core.javanature</nature>
		<nature>org.eclipse.wst.common.project.facet.core.nature</nature>
		<nature>org.eclipse.wst.jsdt.core.jsNature</nature>
	</natures>
</projectDescription>
Fixed code: jboss-negotiation-toolkit/.project
jboss-negotiation-toolkit/.classpath
         if (credentials != null && credentials.length() > 0) {
        	 tmp.setProperty(Context.SECURITY_CREDENTIALS, "***");
         }
            
         if (bindCredential != null && bindCredential.length() > 0) {
        	 tmp.setProperty(BIND_CREDENTIAL, "***");
         }