Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.1397
Important: Red Hat JBoss Fuse/A-MQ 6.0.0 patch 4
8 October 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: JBoss Fuse/A-MQ
Publisher: Red Hat
Operating System: Red Hat
OS X
Windows
Linux variants
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2013-4330 CVE-2013-4271 CVE-2013-4221
Original Bulletin:
https://rhn.redhat.com/errata/RHSA-2013-1410.html
Comment: This advisory references vulnerabilities in products which run on
platforms other than Red Hat. It is recommended that administrators
running JBoss Fuse/A-MQ check for an updated version of the software
for their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat JBoss Fuse/A-MQ 6.0.0 patch 4
Advisory ID: RHSA-2013:1410-01
Product: Fuse Enterprise Middleware
Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-1410.html
Issue date: 2013-10-07
CVE Names: CVE-2013-4221 CVE-2013-4271 CVE-2013-4330
=====================================================================
1. Summary:
Red Hat JBoss Fuse 6.0.0 patch 4, which fixes three security issues and one
bug, is now available from the Red Hat Customer Portal.
The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
2. Description:
Red Hat JBoss Fuse 6.0.0, based on Apache ServiceMix, provides an
integration platform. Red Hat JBoss A-MQ 6.0.0, based on Apache ActiveMQ,
is a standards compliant messaging system that is tailored for use in
mission critical applications.
Red Hat JBoss Fuse/A-MQ 6.0.0 patch 4 is an update to Red Hat JBoss Fuse
6.0.0 and Red Hat JBoss A-MQ 6.0.0. This update addresses the following
security issues:
Restlet applications which use ObjectRepresentation to map HTTP request
data directly to an object deserialize arbitrary user-provided XML using
XMLDecoder. It was found that XMLDecoder deserialized an attacker-provided
definition of a class and executed its methods. A remote attacker could use
this flaw to perform arbitrary remote code execution in the context of the
server running the Restlet application. (CVE-2013-4221)
A flaw was found in the way Restlet handled deserialization. Restlet
applications which use ObjectRepresentation to map HTTP request data
directly to an object deserialize arbitrary user-provided serialized
data. A remote attacker could use this flaw to trigger the execution of the
deserialization methods in any serializable class deployed on the server.
This could lead to a variety of security impacts depending on the
deserialization logic of these classes. (CVE-2013-4271)
A flaw was found in Apache Camel's parsing of the FILE_NAME header. A
remote attacker able to submit messages to a Camel route, which would write
the provided message to a file, could provide expression language (EL)
expressions in the FILE_NAME header, which would be evaluated on the
server. This could lead to arbitrary remote code execution in the context
of the Camel server process. (CVE-2013-4330)
The CVE-2013-4271 issue was discovered by David Jorm of the Red Hat
Security Response Team.
This update also corrected a problem with installing JBoss Fuse 6.0.0 patch
3. When the pax-url-maven-commons bundle was installed in the container,
the installation would fail with a null pointer error. With this update,
the installation does not fail.
All users of Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ 6.0.0 as
provided from the Red Hat Customer Portal are advised to apply this patch.
3. Solution:
The References section of this erratum contains a download link (you must
log in to download the update).
4. Bugs fixed (http://bugzilla.redhat.com/):
995275 - CVE-2013-4221 Restlet: remote code execution due to insecure XML deserialization
999735 - CVE-2013-4271 Restlet: remote code execution due to insecure deserialization
1011726 - CVE-2013-4330 Camel: remote code execution via header field manipulation
5. References:
https://www.redhat.com/security/data/cve/CVE-2013-4221.html
https://www.redhat.com/security/data/cve/CVE-2013-4271.html
https://www.redhat.com/security/data/cve/CVE-2013-4330.html
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse&downloadType=securityPatches&version=6.0.0
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq&downloadType=securityPatches&version=6.0.0
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2013 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFSUu5gXlSAg2UNWIIRAoJRAJ0W0JNiA4rwtdM45zSFgnCOTZxyLACfY9yd
5J9L5U+pi5pzgFV3xZH3fDQ=
=Drch
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUlNS+hLndAQH1ShLAQKcLw/+KSSBcZy5XbSO7ktWM+BQ9GFPSR+1JePU
bSkzw/YaQjVDAwtsTvItEWY1o0rijFwtQ3envP0ZDrj8C1o9/j1VnJwlkVwwDcDy
S5QimiueSusUagtQpvGZHFiciNIU7P2DuGnvHXlkaGL+HFkeL0W6/E7C/UbLrIA/
afGHMOD8/J3D8gHDNwyZRIwnNqqohCF+xGRPjWaZeeAkLd7H3wV+Fmr9tVZ1yxDk
j1pYzNTQmlATikyyt55NK9d6KWG6BJ888V/VlC4V4q54u2fYRmkLU6+JpaDIQ43W
GqqUsgQk25gRn/p4OyvrZHiH2phH2cG3JheHJje8kYB5utwv+c1G2pvKxoryXehy
T1I/0QfvN+k6EP0K7/pGJQfdJuPP45bdYPe33i4k/XauuKVv5z8+LQUbe/L2h/ot
uCEo/3FCzW/2AOUXeFnYZpKetklNmwEBfW6icumMSEktWaQFPbJGpLaSbiMiwlR8
r6DIXMNE24KN9ipU2FkczW/TsKqmeRKTayavp7snmuJiF1pShpWDmJNeKnAZluZS
9x6hiXTrZvdelpZ9UD6CSPg1qn2pSfCFewq/YqD7aS0Ykb6Qc2JGVa+6vnq84uN4
+a8FINuoK+qZPxAeH2CwRM+fuqgkiMpvMyJ2Gwy/XNyXrzh1iM/Mddl21uB5+0Qj
F2spnSTtAXc=
=k/mE
-----END PGP SIGNATURE-----