Issued:
2013-09-09
Updated:
2013-09-09

RHSA-2013:1221 - Important: Fuse Message Broker 5.5.1 security update

Synopsis

Important: Fuse Message Broker 5.5.1 security update

Type/Severity

Security Advisory Important

Topic

An update for the Apache ActiveMQ component of Fuse Message Broker 5.5.1 that fixes one security issue is now available from the Red Hat Customer Portal.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Description

Fuse Message Broker is a messaging platform based on Apache ActiveMQ that provides SOA infrastructure to connect processes across heterogeneous systems.

It was found that, by default, the Apache ActiveMQ web console did not require authentication. A remote attacker could use this flaw to modify the state of the Apache ActiveMQ environment, obtain sensitive information, or cause a denial of service. (CVE-2013-3060)

This update delivers a README file which describes how to manually configure an XML properties file to fix this flaw. Back up existing Fuse Message Broker configuration files before making changes.

Solution

The References section of this erratum contains a download link (you must log in to download the update). Back up existing Fuse Message Broker configuration files before making changes.

Affected Products

ProductVersionArch
Red Hat Fuse1x86_64

Fixes

CVEs

References

Additional information