RHSA-2015:2556 - Security Advisory

Topic

Red Hat JBoss Fuse 6.2.1, which fixes three security issues, several bugs,
and adds various enhancements, is now available from the Red Hat Customer
Portal.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

Description

Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint,
flexible, open source enterprise service bus and integration platform.

Red Hat JBoss Fuse 6.2.1 is a micro product release that updates Red Hat
JBoss Fuse 6.2.0, and includes several bug fixes and enhancements. Refer to
the Release Notes document, available from the link in the References
section, for a list of changes.

The following security fixes are addressed in this release:

It was found that the Apache commons-collections library permitted code
execution when deserializing objects involving a specially constructed
chain of classes. A remote attacker could use this flaw to execute
arbitrary code with the permissions of the application using the
commons-collections library. (CVE-2015-7501)

Further information about this issue may be found at:
https://access.redhat.com/solutions/2045023

A flaw was discovered that when an application uses Groovy (has it on the
classpath) and uses the standard Java serialization mechanism, an attacker
can bake a special serialized object that executes code directly when
deserialized. All applications which rely on serialization and do not
isolate the code which deserializes objects are subject to this
vulnerability. (CVE-2015-3253)

It was found that the JBoss A-MQ console would accept a string containing
JavaScript as the name of a new message queue. Execution of the UI would
subsequently execute the script. An attacker could use this flaw to access
sensitive information or perform other attacks. (CVE-2015-5181)

Red Hat would like to thank Naftali Rosenbaum of Comsec Consulting for
reporting CVE-2015-5181.

All users of Red Hat JBoss Fuse 6.2.0 are advised to apply this update.

Solution

The References section of this erratum contains a download link (you must
log in to download the update).

Affected Products

• Red Hat Fuse 1 x86_64

Fixes

• BZ - 1243934 - CVE-2015-3253 groovy: remote execution of untrusted code in class MethodClosure
• BZ - 1248804 - CVE-2015-5181 A-MQ Console: script injection into queue name
• BZ - 1279330 - CVE-2015-7501 apache-commons-collections: InvokerTransformer code execution during deserialisation

CVEs

• CVE-2015-3253
• CVE-2015-5181
• CVE-2015-7501

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse&downloadType=distributions&version=6.2.1
• https://access.redhat.com/solutions/2045023
• https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_Fuse/