what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2015-2557-01

Red Hat Security Advisory 2015-2557-01
Posted Dec 7, 2015
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2015-2557-01 - Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards-compliant messaging system that is tailored for use in mission critical applications. Red Hat JBoss A-MQ 6.2.1 is a micro product release that updates Red Hat JBoss A-MQ 6.2.0, and includes several bug fixes and enhancements.

tags | advisory
systems | linux, redhat
advisories | CVE-2015-3253, CVE-2015-5181, CVE-2015-7501
SHA-256 | 28cad0dd0104739c3ad7b7dd395f265103b51b4d72b5188b28db0b5ee73e6f47

Red Hat Security Advisory 2015-2557-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Important: Red Hat JBoss A-MQ 6.2.1 update
Advisory ID: RHSA-2015:2557-01
Product: Red Hat JBoss A-MQ
Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2557.html
Issue date: 2015-12-07
CVE Names: CVE-2015-3253 CVE-2015-5181 CVE-2015-7501
=====================================================================

1. Summary:

Red Hat JBoss A-MQ 6.2.1, which fixes three security issues, several bugs,
and adds various enhancements, is now available from the Red Hat Customer
Portal.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

2. Description:

Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards-compliant
messaging system that is tailored for use in mission critical applications.

Red Hat JBoss A-MQ 6.2.1 is a micro product release that updates Red Hat
JBoss A-MQ 6.2.0, and includes several bug fixes and enhancements. Refer to
the Release Notes document, available from the link in the References
section, for a list of changes.

The following security fixes are addressed in this release:

It was found that the Apache commons-collections library permitted code
execution when deserializing objects involving a specially constructed
chain of classes. A remote attacker could use this flaw to execute
arbitrary code with the permissions of the application using the
commons-collections library. (CVE-2015-7501)

Further information about this issue may be found at:
https://access.redhat.com/solutions/2045023

A flaw was discovered that when an application uses Groovy (has it on the
classpath) and uses the standard Java serialization mechanism, an attacker
can bake a special serialized object that executes code directly when
deserialized. All applications which rely on serialization and do not
isolate the code which deserializes objects are subject to this
vulnerability. (CVE-2015-3253)

It was found that the JBoss A-MQ console would accept a string containing
JavaScript as the name of a new message queue. Execution of the UI would
subsequently execute the script. An attacker could use this flaw to access
sensitive information or perform other attacks. (CVE-2015-5181)

Red Hat would like to thank Naftali Rosenbaum of Comsec Consulting for
reporting CVE-2015-5181.

All users of Red Hat JBoss A-MQ 6.2.0 as provided from the Red Hat Customer
Portal are advised to apply this update.

3. Solution:

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1243934 - CVE-2015-3253 groovy: remote execution of untrusted code in class MethodClosure
1248804 - CVE-2015-5181 A-MQ Console: script injection into queue name
1279330 - CVE-2015-7501 apache-commons-collections: InvokerTransformer code execution during deserialisation

5. JIRA issues fixed (https://issues.jboss.org/):

ENTESB-4398 - Arbitrary remote code execution with InvokerTransformer

6. References:

https://access.redhat.com/security/cve/CVE-2015-3253
https://access.redhat.com/security/cve/CVE-2015-5181
https://access.redhat.com/security/cve/CVE-2015-7501
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq&downloadType=distributions&version=6.2.1
https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_A-MQ/
https://access.redhat.com/solutions/2045023

7. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2015 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFWZfDTXlSAg2UNWIIRAqQWAKCpTMbovQc86F5F7S/qYSm7epk/SwCgkRp3
Q/CL1ZUdh8dNmyM/xz89F24=
=/MKe
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

September 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    2 Files
  • 2
    Sep 2nd
    21 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    17 Files
  • 5
    Sep 5th
    34 Files
  • 6
    Sep 6th
    29 Files
  • 7
    Sep 7th
    11 Files
  • 8
    Sep 8th
    25 Files
  • 9
    Sep 9th
    0 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    26 Files
  • 12
    Sep 12th
    23 Files
  • 13
    Sep 13th
    17 Files
  • 14
    Sep 14th
    22 Files
  • 15
    Sep 15th
    16 Files
  • 16
    Sep 16th
    0 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    19 Files
  • 19
    Sep 19th
    60 Files
  • 20
    Sep 20th
    23 Files
  • 21
    Sep 21st
    15 Files
  • 22
    Sep 22nd
    8 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close