[RHSA-2015:0138-01] Important: Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 security update

[bugzilla at redhat.com]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 security update
Advisory ID:       RHSA-2015:0138-01
Product:           Fuse Enterprise Middleware
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2015-0138.html
Issue date:        2015-02-05
CVE Names:         CVE-2014-3600 CVE-2014-3612 
=====================================================================

1. Summary:

Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P8 (Patch 8 on Rollup Patch 1),
which fixes two security issues, is now available from the Red Hat Customer
Portal.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

2. Description:

Fuse ESB Enterprise is an integration platform based on Apache ServiceMix.
Fuse MQ Enterprise, based on Apache ActiveMQ, is a standards-compliant
messaging system that is tailored for use in mission critical applications.

This release of Fuse ESB Enterprise/MQ Enterprise 7.1.0 Patch 8 on Rollup
Patch 1 (R1 P8) is an update to Fuse ESB Enterprise 7.1.0 and Fuse MQ
Enterprise 7.1.0. The following security issues are addressed with this
release:

It was found that if a configured LDAP server supported the unauthenticated
authentication mechanism (as described by RFC 4513), the LDAPLoginModule
implementation, provided by ActiveMQ Java Authentication and Authorization
Service (JAAS), would consider an authentication attempt to be successful
for a valid user that provided an empty password. A remote attacker could
use this flaw to bypass the authentication mechanism of an application
using LDAPLoginModule, and assume a role of any valid user within
that application. (CVE-2014-3612)

It was discovered that Apache ActiveMQ performed XML External Entity (XXE)
expansion when evaluating XPath expressions. A remote, attacker-controlled
consumer able to specify an XPath-based selector to dequeue XML messages
from an Apache ActiveMQ broker could use this flaw to read files accessible
to the user running the broker, and potentially perform other more advanced
XXE attacks. (CVE-2014-3600)

Red Hat would like to thank Georgi Geshev of MWR Labs for reporting these
issues.

Refer to the readme.txt file included with the patch files for
installation instructions.

All users of Fuse ESB Enterprise/MQ Enterprise 7.1.0 as provided from the
Red Hat Customer Portal are advised to upgrade to Fuse ESB Enterprise/MQ
Enterprise 7.1.0 R1 P8.

3. Solution:

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1133649 - CVE-2014-3600 Apache ActiveMQ: XXE via XPath expression evaluation
1135912 - CVE-2014-3612 ActiveMQ JAAS: LDAPLoginModule allows empty password authentication

5. References:

https://access.redhat.com/security/cve/CVE-2014-3600
https://access.redhat.com/security/cve/CVE-2014-3612
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.esb.enterprise&downloadType=securityPatches&version=7.1.0
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.mq.enterprise&downloadType=securityPatches&version=7.1.0

6. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2015 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFU0+jaXlSAg2UNWIIRAnHyAKC6bxSxNiDSQupoV7dBJRdIZnt4KgCgkO/n
tSPvAEQqFrtz00U4VxS1eM8=
=cPvI
-----END PGP SIGNATURE-----