exploit the possibilities

Red Hat Security Advisory 2017-0868-01

Red Hat Security Advisory 2017-0868-01
Posted Apr 3, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-0868-01 - Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications. This patch is an update to Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. It includes bug fixes and enhancements, which are documented in the readme.txt file included with the patch files. Multiple security issues have been addressed.

tags | advisory
systems | linux, redhat
advisories | CVE-2012-5783, CVE-2015-1427, CVE-2016-1000229, CVE-2016-6812, CVE-2016-6814, CVE-2016-8739, CVE-2016-9177, CVE-2017-3159
MD5 | 9d5682a768f54b6bab2b4f6020bf5895

Red Hat Security Advisory 2017-0868-01

Change Mirror Download

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Important: Red Hat JBoss Fuse/A-MQ 6.3 R2 security and bug fix update
Advisory ID: RHSA-2017:0868-01
Product: Red Hat JBoss Fuse
Advisory URL: https://access.redhat.com/errata/RHSA-2017:0868
Issue date: 2017-04-03
CVE Names: CVE-2012-5783 CVE-2015-1427 CVE-2016-1000229
CVE-2016-6812 CVE-2016-6814 CVE-2016-8739
CVE-2016-9177 CVE-2017-3159
=====================================================================

1. Summary:

An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint,
flexible, open source enterprise service bus and integration platform. Red
Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant
messaging system that is tailored for use in mission critical applications.

This patch is an update to Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ
6.3. It includes bug fixes and enhancements, which are documented in the
readme.txt file included with the patch files.

Security Fix(es):

* It was reported that Elasticsearch had vulnerabilities in the Groovy
scripting engine, which allow an attacker to construct scripts that escape
the sandbox and execute shell commands as the user running the
Elasticsearch Java VM. (CVE-2015-1427)

* It was found that a flaw in Apache groovy library allows remote code
execution wherever deserialization occurs in the application. It is
possible for an attacker to craft a special serialized object that will
execute code directly when deserialized. All applications which rely on
serialization and do not isolate the code which deserializes objects are
subject to this vulnerability. (CVE-2016-6814)

* It was found that Apache Commons HttpClient does not verify that the
server hostname matches a domain name in the subject's Common Name (CN) or
subjectAltName field of the X.509 certificate, which allows
man-in-the-middle attackers to spoof SSL servers via an arbitrary valid
certificate. (CVE-2012-5783)

* It was found that swagger-ui contains a cross site scripting (XSS)
vulnerability in the key names in the JSON document. An attacker could use
this flaw to supply a key name with script tags which could cause arbitrary
code execution. Additionally it is possible to load the arbitrary JSON
files remotely via the URL query-string parameter. (CVE-2016-1000229)

* A vulnerability was found in FormattedServiceListWriter in Apache CXF
HTTP transport module that could allow an attacker to inject unexpected
matrix parameters into the request URL. On a successful injection these
matrix parameters will find their way back to the client in the services
list page which represents an XSS risk to the client. (CVE-2016-6812)

* Apache CXF JAX-RS implementation provides a number of Atom
MessageBodyReaders. These readers use Apache Abdera Parser to parse Atom
feeds or Entries, with this Parser expanding XML entities by default. It
was found that this represents a major XXE risk. (CVE-2016-8739)

* A path traversal issue was found in Spark version 2.5 and potentially
earlier versions. The vulnerability resides in the functionality to serve
static files where there's no protection against directory traversal
attacks. This could allow attackers access to private files including
sensitive data. (CVE-2016-9177)

* It was found that the camel-snakeyaml component is exploitable for code
execution. An attacker could use this vulnerability to send specially
crafted payload to a camel-snakeyaml endpoint and causing a remote code
execution attack. (CVE-2017-3159)

3. Solution:

Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.

It is recommended to halt the server by stopping the JBoss Application
Server process before installing this update; after installing the update,
restart the server by starting the JBoss Application Server process.

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

873317 - CVE-2012-5783 jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name
1191969 - CVE-2015-1427 elasticsearch: remote code execution via Groovy sandbox bypass
1360275 - CVE-2016-1000229 swagger-ui: cross-site scripting in key names
1393607 - CVE-2016-9177 Spark: Directory traversal vulnerability in version 2.5
1406810 - CVE-2016-6812 apache-cxf: XSS in Apache CXF FormattedServiceListWriter
1406811 - CVE-2016-8739 apache-cxf: Atom entity provider of Apache CXF JAX-RS is vulnerable to XXE
1413466 - CVE-2016-6814 Apache Groovy: Remote code execution via deserialization
1420834 - CVE-2017-3159 camel-snakeyaml: Unmarshalling operation is vulnerable to RCE

5. References:

https://access.redhat.com/security/cve/CVE-2012-5783
https://access.redhat.com/security/cve/CVE-2015-1427
https://access.redhat.com/security/cve/CVE-2016-1000229
https://access.redhat.com/security/cve/CVE-2016-6812
https://access.redhat.com/security/cve/CVE-2016-6814
https://access.redhat.com/security/cve/CVE-2016-8739
https://access.redhat.com/security/cve/CVE-2016-9177
https://access.redhat.com/security/cve/CVE-2017-3159
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse&downloadType=securityPatches&version=6.3.0
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq&downloadType=securityPatches&version=6.3.0
https://access.redhat.com/documentation/en/red-hat-jboss-fuse/

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2017 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFY4rjtXlSAg2UNWIIRAryMAKCPl0Ov02ApsDlQ2LSSWEgE/QSz+ACgnzyt
V+DkiT6TvH3/Ajnf1bJ8rAE=
=blvE
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    28 Files
  • 2
    Nov 2nd
    1 Files
  • 3
    Nov 3rd
    1 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    19 Files
  • 6
    Nov 6th
    65 Files
  • 7
    Nov 7th
    22 Files
  • 8
    Nov 8th
    18 Files
  • 9
    Nov 9th
    1 Files
  • 10
    Nov 10th
    1 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    65 Files
  • 13
    Nov 13th
    27 Files
  • 14
    Nov 14th
    22 Files
  • 15
    Nov 15th
    18 Files
  • 16
    Nov 16th
    1 Files
  • 17
    Nov 17th
    3 Files
  • 18
    Nov 18th
    22 Files
  • 19
    Nov 19th
    17 Files
  • 20
    Nov 20th
    15 Files
  • 21
    Nov 21st
    1 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close