exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2014-0323-01

Red Hat Security Advisory 2014-0323-01
Posted Mar 24, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0323-01 - Red Hat JBoss Fuse 6.0.0 is an integration platform based on Apache ServiceMix. Red Hat JBoss A-MQ 6.0.0, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications. This patch is an update to Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ 6.0.0. It includes bug fixes, which are documented in the readme file included with the patch files.

tags | advisory
systems | linux, redhat
advisories | CVE-2013-7285, CVE-2014-0002, CVE-2014-0003
SHA-256 | 4033631904ad3db4b86abd7def5c87820283de0a4d5d1c79aaedd5f2366bee35

Red Hat Security Advisory 2014-0323-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Important: Red Hat JBoss Fuse/A-MQ 6.0.0 security update
Advisory ID: RHSA-2014:0323-01
Product: Red Hat JBoss Fuse
Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0323.html
Issue date: 2014-03-24
CVE Names: CVE-2013-7285 CVE-2014-0002 CVE-2014-0003
=====================================================================

1. Summary:

Red Hat JBoss Fuse and A-MQ 6.0.0 R1 P3 (Patch 3 on Rollup Patch 1), which
addresses three security issues and contains several bug fixes, is now
available from the Red Hat Customer Portal.

The Red Hat Security Response Team has rated this update as having
Important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

2. Description:

Red Hat JBoss Fuse 6.0.0 is an integration platform based on Apache
ServiceMix. Red Hat JBoss A-MQ 6.0.0, based on Apache ActiveMQ, is a
standards compliant messaging system that is tailored for use in mission
critical applications.

This patch is an update to Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ
6.0.0. It includes bug fixes, which are documented in the readme file
included with the patch files.

The following security issues are fixed with this release:

It was found that XStream could deserialize arbitrary user-supplied XML
content, representing objects of any type. A remote attacker able to pass
XML to XStream could use this flaw to perform a variety of attacks,
including remote code execution in the context of the server running the
XStream application. (CVE-2013-7285)

It was found that the Apache Camel XSLT component allowed XSL stylesheets
to call external Java methods. A remote attacker able to submit messages to
a Camel route could use this flaw to perform arbitrary remote code
execution in the context of the Camel server process. (CVE-2014-0003)

It was found that the Apache Camel XSLT component would resolve entities in
XML messages when transforming them using an XSLT route. A remote attacker
able to submit messages to an XSLT Camel route could use this flaw to read
files accessible to the user running the application server and,
potentially, perform other more advanced XML External Entity (XXE) attacks.
(CVE-2014-0002)

The CVE-2014-0003 and CVE-2014-0002 issues were discovered by David Jorm of
the Red Hat Security Response Team.

All users of Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ 6.0.0 as
provided from the Red Hat Customer Portal are advised to apply this patch.

3. Solution:

The References section of this erratum contains download links (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1049675 - CVE-2014-0002 Camel: XML eXternal Entity (XXE) flaw in XSLT component
1049692 - CVE-2014-0003 Camel: remote code execution via XSL
1051277 - CVE-2013-7285 XStream: remote code execution due to insecure XML deserialization

5. References:

https://www.redhat.com/security/data/cve/CVE-2013-7285.html
https://www.redhat.com/security/data/cve/CVE-2014-0002.html
https://www.redhat.com/security/data/cve/CVE-2014-0003.html
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse&downloadType=securityPatches&version=6.0.0
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq&downloadType=securityPatches&version=6.0.0

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2014 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFTMHTDXlSAg2UNWIIRAgxrAKCBokPQTtEQSIIheko8LRMu35DsZwCfVBQU
lcR5+RT80azmerMU8TJOIeE=
=j5uJ
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close