- Issued:
- 2013-10-07
- Updated:
- 2013-10-07
RHSA-2013:1410 - Important: Red Hat JBoss Fuse/A-MQ 6.0.0 patch 4
Synopsis
Important: Red Hat JBoss Fuse/A-MQ 6.0.0 patch 4
Type/Severity
Security Advisory Important
Topic
Red Hat JBoss Fuse 6.0.0 patch 4, which fixes three security issues and one bug, is now available from the Red Hat Customer Portal.
The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Description
Red Hat JBoss Fuse 6.0.0, based on Apache ServiceMix, provides an integration platform. Red Hat JBoss A-MQ 6.0.0, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.
Red Hat JBoss Fuse/A-MQ 6.0.0 patch 4 is an update to Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ 6.0.0. This update addresses the following security issues:
Restlet applications which use ObjectRepresentation to map HTTP request data directly to an object deserialize arbitrary user-provided XML using XMLDecoder. It was found that XMLDecoder deserialized an attacker-provided definition of a class and executed its methods. A remote attacker could use this flaw to perform arbitrary remote code execution in the context of the server running the Restlet application. (CVE-2013-4221)
A flaw was found in the way Restlet handled deserialization. Restlet applications which use ObjectRepresentation to map HTTP request data directly to an object deserialize arbitrary user-provided serialized data. A remote attacker could use this flaw to trigger the execution of the deserialization methods in any serializable class deployed on the server. This could lead to a variety of security impacts depending on the deserialization logic of these classes. (CVE-2013-4271)
A flaw was found in Apache Camel's parsing of the FILE_NAME header. A remote attacker able to submit messages to a Camel route, which would write the provided message to a file, could provide expression language (EL) expressions in the FILE_NAME header, which would be evaluated on the server. This could lead to arbitrary remote code execution in the context of the Camel server process. (CVE-2013-4330)
The CVE-2013-4271 issue was discovered by David Jorm of the Red Hat Security Response Team.
This update also corrected a problem with installing JBoss Fuse 6.0.0 patch 3. When the pax-url-maven-commons bundle was installed in the container, the installation would fail with a null pointer error. With this update, the installation does not fail.
All users of Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ 6.0.0 as provided from the Red Hat Customer Portal are advised to apply this patch.
Solution
The References section of this erratum contains a download link (you must log in to download the update).
Affected Products
| Product | Version | Arch |
|---|---|---|
| Red Hat Fuse | 1 | x86_64 |
Fixes
- This content is not included.BZ - 995275
- This content is not included.BZ - 999735
- This content is not included.BZ - 1011726
CVEs
References
- https://access.redhat.com/security/updates/classification/#important
- This content is not included.This content is not included.https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse&downloadType=securityPatches&version=6.0.0
- This content is not included.This content is not included.https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq&downloadType=securityPatches&version=6.0.0
Additional information
- The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
- Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.