Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.1831
Important: Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update
20 December 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Fuse ESB Enterprise
Fuse MQ Enterprise
Publisher: Red Hat
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Red Hat
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Create Arbitrary Files -- Remote/Unauthenticated
Cross-site Scripting -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2013-4372 CVE-2013-4330 CVE-2013-4271
CVE-2013-4221 CVE-2013-1768
Reference: ESB-2013.1397
ESB-2013.1341
ESB-2013.1240
ESB-2013.1181
ESB-2013.1133
ESB-2013.0841
Original Bulletin:
https://rhn.redhat.com/errata/RHSA-2013-1862.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update
Advisory ID: RHSA-2013:1862-01
Product: Fuse Enterprise Middleware
Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-1862.html
Issue date: 2013-12-19
CVE Names: CVE-2013-1768 CVE-2013-4221 CVE-2013-4271
CVE-2013-4330 CVE-2013-4372
=====================================================================
1. Summary:
Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P1 (Patch 1 on Rollup Patch 1),
which contains several bug fixes and addresses several security issues, is
now available from the Red Hat Customer Portal.
The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
2. Description:
Fuse ESB Enterprise is an integration platform based on Apache ServiceMix.
Fuse MQ Enterprise, based on Apache ActiveMQ, is a standards compliant
messaging system that is tailored for use in mission critical applications.
This release of Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P1 is an update
to Fuse ESB Enterprise 7.1.0 and Fuse MQ Enterprise 7.1.0. It includes bug
fixes. Refer to the readme file included with the patch files for
information about the bug fixes.
The following security issues are also fixed with this release:
A flaw was found in the logging performed during deserialization of the
BrokerFactory class in Apache OpenJPA. A remote attacker able to supply a
serialized instance of the BrokerFactory class, which will be deserialized
on a server, could use this flaw to write an executable file to the
server's file system. (CVE-2013-1768)
Restlet applications, which used ObjectRepresentation to map HTTP request
data directly to an object, deserialized arbitrary user-provided XML using
XMLDecoder. XMLDecoder deserialized an attacker-provided definition of a
class and executed its methods. A remote attacker could use this flaw to
perform remote code execution in the context of the server running the
Restlet application. (CVE-2013-4221)
A flaw was found in the way Restlet handled deserialization.
Restlet applications, which used ObjectRepresentation to map HTTP request
data directly to an object, deserialized arbitrary user-provided serialized
data. A remote attacker could use this flaw to trigger the execution of the
deserialization methods in any serializable class deployed on the server.
This could lead to a variety of security impacts depending on the
deserialization logic of these classes. (CVE-2013-4271)
A flaw was found in Apache Camel's parsing of the FILE_NAME header.
A remote attacker able to submit messages to a Camel route, which would
write the provided message to a file, could provide expression language
(EL) expressions in the FILE_NAME header, which would be evaluated on the
server. This could lead to arbitrary remote code execution in the context
of the Camel server process. (CVE-2013-4330)
Multiple stored cross-site scripting (XSS) flaws were found in the Fuse
Management Console. A remote attacker could use this flaw to perform an XSS
attack against other users of the Fuse Management Console. (CVE-2013-4372)
The CVE-2013-4271 issue was discovered by David Jorm of the Red Hat
Security Response Team.
All users of Fuse ESB Enterprise/MQ Enterprise 7.1.0 as provided from the
Red Hat Customer Portal are advised to upgrade to Fuse ESB Enterprise/MQ
Enterprise 7.1.0 R1 P1.
3. Solution:
The References section of this erratum contains a download link (you must
log in to download the update).
4. Bugs fixed (https://bugzilla.redhat.com/):
984034 - CVE-2013-1768 openjpa: Remote arbitrary code execution by creating a serialized object and leveraging improperly secured server programs
995275 - CVE-2013-4221 Restlet: remote code execution due to insecure XML deserialization
999735 - CVE-2013-4271 Restlet: remote code execution due to insecure deserialization
1011726 - CVE-2013-4330 Camel: remote code execution via header field manipulation
1011736 - CVE-2013-4372 Fuse Management Console: Stored cross-site scripting (XSS)
5. References:
https://www.redhat.com/security/data/cve/CVE-2013-1768.html
https://www.redhat.com/security/data/cve/CVE-2013-4221.html
https://www.redhat.com/security/data/cve/CVE-2013-4271.html
https://www.redhat.com/security/data/cve/CVE-2013-4330.html
https://www.redhat.com/security/data/cve/CVE-2013-4372.html
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.esb.enterprise&downloadType=securityPatches&version=7.1.0
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.mq.enterprise&downloadType=securityPatches&version=7.1.0
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2013 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFSs4OAXlSAg2UNWIIRAo8jAJ9UPehPbrPh9Rwta5l8FAWxOR6qfwCeKd+H
VvNFcXWzlgfzq8KyZq9SvuY=
=VQ4p
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUrOv2BLndAQH1ShLAQIjuxAAiGJw31USiszcGgOn+ItzaUT5h+q1SDjS
ArUJCiirEswoz3dJdE5rkgVv2ymHrVPiFKf0h2uOctipDa2D06EXEIiyotYSuLsm
UmD9Y1eMiJyM85bx975v04L9TRgW6qNGu/AEnujjJcy9BwZX3fMdWg9+GAKnjSUj
OxCm5ZXg1SECeYbAMQluRRDbCk6cjiP9p14QACoqyjGiOUvjRVYXywkw1VoOT7mt
IX5ljzV1/T132t68dRPxWGJ0PIOm1PnaiAdYWdKYktA8ccrutLSmAo0d+q7OkWce
G9Ni6h9zm2syEuJjNklmUuh2TVEqWqidzJh99th1a8hqSR2Lp/ZNFcws4+S1cR53
EHeRXGshFfCnUlNW7PxjUczce+2CfTsO5ECbiZ8NZngTuePnDj3CXa2lYA0CTv7O
nlQ4dJsk/VV38HWHRE/XsFuVxXXWYUDqj4B2f6u2S/QTPbXnNFgNddnTrKL2Dc/R
+ZHXc8t9tVWQZ+8e9I/kIiMezWnod0AKmIkut7MmWcJl9Py9X+Llponro9PMygHW
LQSWuDa4DVk0RdWOM4znjr1ZFXH9+ZbuvdhDq5ExndW0J1yfqgeaaFaaJSG+vk93
hHruiIOKe0Jt0ONizq0XtZGGb/e9hjDjkQjj4bHdEQY296XPUyPi0Mxzj0Ynv3mB
/vlkXXqwppg=
=E/qx
-----END PGP SIGNATURE-----