-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat JBoss Fuse/A-MQ 6.1.0 security update
Advisory ID:       RHSA-2014:1351-01
Product:           Red Hat JBoss Fuse
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2014-1351.html
Issue date:        2014-10-01
CVE Names:         CVE-2014-0034 CVE-2014-0035 CVE-2014-0074 
                   CVE-2014-0107 CVE-2014-0109 CVE-2014-0110 
                   CVE-2014-0168 CVE-2014-0193 CVE-2014-0225 
=====================================================================

1. Summary:

Red Hat JBoss Fuse and A-MQ 6.1.0 Rollup Patch 1, which addresses several
security issues, multiple bug fixes, and adds various enhancements, is now
available from the Red Hat Customer Portal.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

2. Description:

Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint,
flexible, open source enterprise service bus and integration platform.
Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant
messaging system that is tailored for use in mission critical applications.

This patch is an update to Red Hat JBoss Fuse 6.1.0 and Red Hat JBoss A-MQ
6.1.0. It includes bug fixes and enhancements, which are documented in the
readme.txt file included with the patch files. The following security
issues are addressed in this release:

It was discovered that Apache Shiro authenticated users without specifying
a user name or a password when used in conjunction with an LDAP back end
that allowed unauthenticated binds. (CVE-2014-0074)

It was found that the secure processing feature of Xalan-Java had
insufficient restrictions defined for certain properties and features.
A remote attacker able to provide Extensible Stylesheet Language
Transformations (XSLT) content to be processed by an application using
Xalan-Java could use this flaw to bypass the intended constraints of the
secure processing feature. Depending on the components available in the
classpath, this could lead to arbitrary remote code execution in the
context of the application server running the application that uses
Xalan-Java. (CVE-2014-0107)

It was found that the SecurityTokenService (STS), provided as a part of
Apache CXF, could under certain circumstances accept invalid SAML tokens as
valid. A remote attacker could use a specially crafted SAML token to gain
access to an application that uses STS for validation of SAML tokens.
(CVE-2014-0034)

A denial of service flaw was found in the way Apache CXF created error
messages for certain POST requests. A remote attacker could send a
specially crafted request which, when processed by an application using
Apache CXF, could consume an excessive amount of memory on the system,
possibly triggering an Out Of Memory (OOM) error. (CVE-2014-0109)

It was found that when a large invalid SOAP message was processed by Apache
CXF, it could be saved to a temporary file in the /tmp directory. A remote
attacker could send a specially crafted SOAP message that, when processed
by an application using Apache CXF, would use an excessive amount of disk
space, possibly causing a denial of service. (CVE-2014-0110)

It was found that Jolokia was vulnerable to Cross-Site Request Forgery
(CSRF) attacks. A remote attacker could provide a specially crafted web
page that, when visited by a user logged in to Jolokia, could allow the
attacker to execute arbitrary methods on MBeans exposed via JMX.
(CVE-2014-0168)

It was found that the Spring Framework did not, by default, disable the
resolution of URI references in a DTD declaration when processing
user-provided XML documents. By observing differences in response times, an
attacker could identify valid IP addresses on the internal network with
functioning web servers. (CVE-2014-0225)

It was discovered that UsernameTokens were sent in plain text by an Apache
CXF client that used a Symmetric EncryptBeforeSigning password policy.
A man-in-the-middle attacker could use this flaw to obtain the user name
and password used by the client application using Apache CXF.
(CVE-2014-0035)

A flaw was found in the WebSocket08FrameDecoder implementation that could
allow a remote attacker to trigger an Out Of Memory Exception by issuing a
series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on
the server configuration, this could lead to a denial of service.
(CVE-2014-0193)

Refer to the readme.txt file included with the patch files for
installation instructions.

Red Hat would like to thank James Roper of Typesafe for reporting the
CVE-2014-0193 issue.

All users of Red Hat JBoss Fuse 6.1.0 and Red Hat JBoss A-MQ 6.1.0 as
provided from the Red Hat Customer Portal are advised to apply this
security update.

3. Solution:

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1072603 - CVE-2014-0074 Apache Shiro: successful authentication without specifying user name or password
1080248 - CVE-2014-0107 Xalan-Java: insufficient constraints in secure processing feature
1084838 - CVE-2014-0168 Jolokia: cross-site request forgery (CSRF)
1092783 - CVE-2014-0193 netty: DoS via memory exhaustion during data aggregation
1093526 - CVE-2014-0109 Apache CXF: HTML content posted to SOAP endpoint could cause OOM errors
1093527 - CVE-2014-0110 Apache CXF: Large invalid content could cause temporary space to fill
1093529 - CVE-2014-0034 Apache CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid
1093530 - CVE-2014-0035 Apache CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy
1110110 - CVE-2014-0225 Spring Framework: Information disclosure via SSRF

5. References:

https://www.redhat.com/security/data/cve/CVE-2014-0034.html
https://www.redhat.com/security/data/cve/CVE-2014-0035.html
https://www.redhat.com/security/data/cve/CVE-2014-0074.html
https://www.redhat.com/security/data/cve/CVE-2014-0107.html
https://www.redhat.com/security/data/cve/CVE-2014-0109.html
https://www.redhat.com/security/data/cve/CVE-2014-0110.html
https://www.redhat.com/security/data/cve/CVE-2014-0168.html
https://www.redhat.com/security/data/cve/CVE-2014-0193.html
https://www.redhat.com/security/data/cve/CVE-2014-0225.html
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse&downloadType=securityPatches&version=6.1.0

6. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2014 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFULFL0XlSAg2UNWIIRAoi3AJ0VFbjJDO+Gxezhg5l1BKhNPNLa9QCgjYGW
EPv9aB5VOthoXWY+ITIPO8I=
=krP3
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce