what you don't know can hurt you

Red Hat Security Advisory 2014-1351-01

Red Hat Security Advisory 2014-1351-01
Posted Oct 2, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1351-01 - Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications. This patch is an update to Red Hat JBoss Fuse 6.1.0 and Red Hat JBoss A-MQ 6.1.0. It includes bug fixes and enhancements, which are documented in the readme.txt file included with the patch files. The following security issues are addressed in this release: It was discovered that Apache Shiro authenticated users without specifying a user name or a password when used in conjunction with an LDAP back end that allowed unauthenticated binds.

tags | advisory
systems | linux, redhat
advisories | CVE-2014-0034, CVE-2014-0035, CVE-2014-0074, CVE-2014-0107, CVE-2014-0109, CVE-2014-0110, CVE-2014-0168, CVE-2014-0193, CVE-2014-0225
MD5 | 2cb7c95a13feefb84613d912885eae74

Red Hat Security Advisory 2014-1351-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Important: Red Hat JBoss Fuse/A-MQ 6.1.0 security update
Advisory ID: RHSA-2014:1351-01
Product: Red Hat JBoss Fuse
Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-1351.html
Issue date: 2014-10-01
CVE Names: CVE-2014-0034 CVE-2014-0035 CVE-2014-0074
CVE-2014-0107 CVE-2014-0109 CVE-2014-0110
CVE-2014-0168 CVE-2014-0193 CVE-2014-0225
=====================================================================

1. Summary:

Red Hat JBoss Fuse and A-MQ 6.1.0 Rollup Patch 1, which addresses several
security issues, multiple bug fixes, and adds various enhancements, is now
available from the Red Hat Customer Portal.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

2. Description:

Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint,
flexible, open source enterprise service bus and integration platform.
Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant
messaging system that is tailored for use in mission critical applications.

This patch is an update to Red Hat JBoss Fuse 6.1.0 and Red Hat JBoss A-MQ
6.1.0. It includes bug fixes and enhancements, which are documented in the
readme.txt file included with the patch files. The following security
issues are addressed in this release:

It was discovered that Apache Shiro authenticated users without specifying
a user name or a password when used in conjunction with an LDAP back end
that allowed unauthenticated binds. (CVE-2014-0074)

It was found that the secure processing feature of Xalan-Java had
insufficient restrictions defined for certain properties and features.
A remote attacker able to provide Extensible Stylesheet Language
Transformations (XSLT) content to be processed by an application using
Xalan-Java could use this flaw to bypass the intended constraints of the
secure processing feature. Depending on the components available in the
classpath, this could lead to arbitrary remote code execution in the
context of the application server running the application that uses
Xalan-Java. (CVE-2014-0107)

It was found that the SecurityTokenService (STS), provided as a part of
Apache CXF, could under certain circumstances accept invalid SAML tokens as
valid. A remote attacker could use a specially crafted SAML token to gain
access to an application that uses STS for validation of SAML tokens.
(CVE-2014-0034)

A denial of service flaw was found in the way Apache CXF created error
messages for certain POST requests. A remote attacker could send a
specially crafted request which, when processed by an application using
Apache CXF, could consume an excessive amount of memory on the system,
possibly triggering an Out Of Memory (OOM) error. (CVE-2014-0109)

It was found that when a large invalid SOAP message was processed by Apache
CXF, it could be saved to a temporary file in the /tmp directory. A remote
attacker could send a specially crafted SOAP message that, when processed
by an application using Apache CXF, would use an excessive amount of disk
space, possibly causing a denial of service. (CVE-2014-0110)

It was found that Jolokia was vulnerable to Cross-Site Request Forgery
(CSRF) attacks. A remote attacker could provide a specially crafted web
page that, when visited by a user logged in to Jolokia, could allow the
attacker to execute arbitrary methods on MBeans exposed via JMX.
(CVE-2014-0168)

It was found that the Spring Framework did not, by default, disable the
resolution of URI references in a DTD declaration when processing
user-provided XML documents. By observing differences in response times, an
attacker could identify valid IP addresses on the internal network with
functioning web servers. (CVE-2014-0225)

It was discovered that UsernameTokens were sent in plain text by an Apache
CXF client that used a Symmetric EncryptBeforeSigning password policy.
A man-in-the-middle attacker could use this flaw to obtain the user name
and password used by the client application using Apache CXF.
(CVE-2014-0035)

A flaw was found in the WebSocket08FrameDecoder implementation that could
allow a remote attacker to trigger an Out Of Memory Exception by issuing a
series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on
the server configuration, this could lead to a denial of service.
(CVE-2014-0193)

Refer to the readme.txt file included with the patch files for
installation instructions.

Red Hat would like to thank James Roper of Typesafe for reporting the
CVE-2014-0193 issue.

All users of Red Hat JBoss Fuse 6.1.0 and Red Hat JBoss A-MQ 6.1.0 as
provided from the Red Hat Customer Portal are advised to apply this
security update.

3. Solution:

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1072603 - CVE-2014-0074 Apache Shiro: successful authentication without specifying user name or password
1080248 - CVE-2014-0107 Xalan-Java: insufficient constraints in secure processing feature
1084838 - CVE-2014-0168 Jolokia: cross-site request forgery (CSRF)
1092783 - CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation
1093526 - CVE-2014-0109 Apache CXF: HTML content posted to SOAP endpoint could cause OOM errors
1093527 - CVE-2014-0110 Apache CXF: Large invalid content could cause temporary space to fill
1093529 - CVE-2014-0034 Apache CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid
1093530 - CVE-2014-0035 Apache CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy
1110110 - CVE-2014-0225 Spring Framework: Information disclosure via SSRF

5. References:

https://www.redhat.com/security/data/cve/CVE-2014-0034.html
https://www.redhat.com/security/data/cve/CVE-2014-0035.html
https://www.redhat.com/security/data/cve/CVE-2014-0074.html
https://www.redhat.com/security/data/cve/CVE-2014-0107.html
https://www.redhat.com/security/data/cve/CVE-2014-0109.html
https://www.redhat.com/security/data/cve/CVE-2014-0110.html
https://www.redhat.com/security/data/cve/CVE-2014-0168.html
https://www.redhat.com/security/data/cve/CVE-2014-0193.html
https://www.redhat.com/security/data/cve/CVE-2014-0225.html
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse&downloadType=securityPatches&version=6.1.0

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2014 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFULFL0XlSAg2UNWIIRAoi3AJ0VFbjJDO+Gxezhg5l1BKhNPNLa9QCgjYGW
EPv9aB5VOthoXWY+ITIPO8I=
=krP3
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    22 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    2 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    50 Files
  • 6
    Feb 6th
    24 Files
  • 7
    Feb 7th
    15 Files
  • 8
    Feb 8th
    6 Files
  • 9
    Feb 9th
    1 Files
  • 10
    Feb 10th
    1 Files
  • 11
    Feb 11th
    22 Files
  • 12
    Feb 12th
    25 Files
  • 13
    Feb 13th
    16 Files
  • 14
    Feb 14th
    32 Files
  • 15
    Feb 15th
    15 Files
  • 16
    Feb 16th
    10 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close