rhsa-2013_1410
Vulnerability from csaf_redhat
Published
2013-10-07 17:13
Modified
2024-11-22 07:28
Summary
Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.0.0 patch 4

Notes

Topic
Red Hat JBoss Fuse 6.0.0 patch 4, which fixes three security issues and one bug, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Details
Red Hat JBoss Fuse 6.0.0, based on Apache ServiceMix, provides an integration platform. Red Hat JBoss A-MQ 6.0.0, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications. Red Hat JBoss Fuse/A-MQ 6.0.0 patch 4 is an update to Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ 6.0.0. This update addresses the following security issues: Restlet applications which use ObjectRepresentation to map HTTP request data directly to an object deserialize arbitrary user-provided XML using XMLDecoder. It was found that XMLDecoder deserialized an attacker-provided definition of a class and executed its methods. A remote attacker could use this flaw to perform arbitrary remote code execution in the context of the server running the Restlet application. (CVE-2013-4221) A flaw was found in the way Restlet handled deserialization. Restlet applications which use ObjectRepresentation to map HTTP request data directly to an object deserialize arbitrary user-provided serialized data. A remote attacker could use this flaw to trigger the execution of the deserialization methods in any serializable class deployed on the server. This could lead to a variety of security impacts depending on the deserialization logic of these classes. (CVE-2013-4271) A flaw was found in Apache Camel's parsing of the FILE_NAME header. A remote attacker able to submit messages to a Camel route, which would write the provided message to a file, could provide expression language (EL) expressions in the FILE_NAME header, which would be evaluated on the server. This could lead to arbitrary remote code execution in the context of the Camel server process. (CVE-2013-4330) The CVE-2013-4271 issue was discovered by David Jorm of the Red Hat Security Response Team. This update also corrected a problem with installing JBoss Fuse 6.0.0 patch 3. When the pax-url-maven-commons bundle was installed in the container, the installation would fail with a null pointer error. With this update, the installation does not fail. All users of Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ 6.0.0 as provided from the Red Hat Customer Portal are advised to apply this patch.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Fuse 6.0.0 patch 4, which fixes three security issues and one\nbug, is now available from the Red Hat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Fuse 6.0.0, based on Apache ServiceMix, provides an\nintegration platform. Red Hat JBoss A-MQ 6.0.0, based on Apache ActiveMQ,\nis a standards compliant messaging system that is tailored for use in\nmission critical applications.\n\nRed Hat JBoss Fuse/A-MQ 6.0.0 patch 4 is an update to Red Hat JBoss Fuse\n6.0.0 and Red Hat JBoss A-MQ 6.0.0. This update addresses the following\nsecurity issues:\n\nRestlet applications which use ObjectRepresentation to map HTTP request\ndata directly to an object deserialize arbitrary user-provided XML using\nXMLDecoder. It was found that XMLDecoder deserialized an attacker-provided\ndefinition of a class and executed its methods. A remote attacker could use\nthis flaw to perform arbitrary remote code execution in the context of the\nserver running the Restlet application. (CVE-2013-4221)\n\nA flaw was found in the way Restlet handled deserialization. Restlet\napplications which use ObjectRepresentation to map HTTP request data\ndirectly to an object deserialize arbitrary user-provided serialized\ndata. A remote attacker could use this flaw to trigger the execution of the\ndeserialization methods in any serializable class deployed on the server.\nThis could lead to a variety of security impacts depending on the\ndeserialization logic of these classes. (CVE-2013-4271)\n\nA flaw was found in Apache Camel\u0027s parsing of the FILE_NAME header. A\nremote attacker able to submit messages to a Camel route, which would write\nthe provided message to a file, could provide expression language (EL)\nexpressions in the FILE_NAME header, which would be evaluated on the\nserver. This could lead to arbitrary remote code execution in the context\nof the Camel server process. (CVE-2013-4330)\n\nThe CVE-2013-4271 issue was discovered by David Jorm of the Red Hat\nSecurity Response Team.\n\nThis update also corrected a problem with installing JBoss Fuse 6.0.0 patch\n3.  When the pax-url-maven-commons bundle was installed in the container,\nthe installation would fail with a null pointer error.  With this update,\nthe installation does not fail.\n\nAll users of Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ 6.0.0 as\nprovided from the Red Hat Customer Portal are advised to apply this patch.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:1410",
        "url": "https://access.redhat.com/errata/RHSA-2013:1410"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.0.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.0.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=securityPatches\u0026version=6.0.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=securityPatches\u0026version=6.0.0"
      },
      {
        "category": "external",
        "summary": "995275",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=995275"
      },
      {
        "category": "external",
        "summary": "999735",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=999735"
      },
      {
        "category": "external",
        "summary": "1011726",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1011726"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1410.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.0.0 patch 4",
    "tracking": {
      "current_release_date": "2024-11-22T07:28:45+00:00",
      "generator": {
        "date": "2024-11-22T07:28:45+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2013:1410",
      "initial_release_date": "2013-10-07T17:13:00+00:00",
      "revision_history": [
        {
          "date": "2013-10-07T17:13:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2013-10-07T17:14:44+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T07:28:45+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss A-MQ 6.0",
                "product": {
                  "name": "Red Hat JBoss A-MQ 6.0",
                  "product_id": "Red Hat JBoss A-MQ 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_amq:6.0.0"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Fuse 6.0",
                "product": {
                  "name": "Red Hat JBoss Fuse 6.0",
                  "product_id": "Red Hat JBoss Fuse 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:6.0.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Fuse Enterprise Middleware"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2013-4221",
      "discovery_date": "2013-08-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "995275"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Restlet: remote code execution due to insecure XML deserialization",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.0",
          "Red Hat JBoss Fuse 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4221"
        },
        {
          "category": "external",
          "summary": "RHBZ#995275",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=995275"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4221",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4221"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4221",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4221"
        },
        {
          "category": "external",
          "summary": "http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html",
          "url": "http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html"
        },
        {
          "category": "external",
          "summary": "http://restlet.org/learn/2.1/changes",
          "url": "http://restlet.org/learn/2.1/changes"
        }
      ],
      "release_date": "2013-08-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-10-07T17:13:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.0",
            "Red Hat JBoss Fuse 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:1410"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.0",
            "Red Hat JBoss Fuse 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Restlet: remote code execution due to insecure XML deserialization"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "David Jorm"
          ],
          "organization": "Red Hat Security Response Team",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2013-4271",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2013-08-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "999735"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allows remote attackers to execute arbitrary Java code via a serialized object, a different vulnerability than CVE-2013-4221.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Restlet: remote code execution due to insecure deserialization",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.0",
          "Red Hat JBoss Fuse 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4271"
        },
        {
          "category": "external",
          "summary": "RHBZ#999735",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=999735"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4271",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4271"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4271",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4271"
        },
        {
          "category": "external",
          "summary": "http://restlet.org/learn/2.1/changes",
          "url": "http://restlet.org/learn/2.1/changes"
        }
      ],
      "release_date": "2013-09-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-10-07T17:13:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.0",
            "Red Hat JBoss Fuse 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:1410"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.0",
            "Red Hat JBoss Fuse 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Restlet: remote code execution due to insecure deserialization"
    },
    {
      "cve": "CVE-2013-4330",
      "discovery_date": "2013-09-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1011726"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including \"$simple{}\" in a CamelFileName message header to a (1) FILE or (2) FTP producer.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Camel: remote code execution via header field manipulation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.0",
          "Red Hat JBoss Fuse 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4330"
        },
        {
          "category": "external",
          "summary": "RHBZ#1011726",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1011726"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4330",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4330"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4330",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4330"
        }
      ],
      "release_date": "2013-09-30T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-10-07T17:13:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.0",
            "Red Hat JBoss Fuse 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:1410"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.0",
            "Red Hat JBoss Fuse 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Camel: remote code execution via header field manipulation"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.