RHSA-2014:0401: Moderate: Red Hat JBoss A-MQ 6.1.0 update

Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards-compliantmessaging system that is tailored for use in mission critical applications.Red Hat JBoss A-MQ 6.1.0 is a minor product release that updates Red HatJBoss A-MQ 6.0.0 and includes several bug fixes and enhancements. Refer tothe Release Notes document, available from the link in the Referencessection, for a list of changes.The following security issues are resolved with this update:A flaw was found in the Apache Hadoop RPC protocol. A man-in-the-middleattacker could possibly use this flaw to unilaterally disable bidirectionalauthentication between a client and a server, forcing a downgrade to simple(unidirectional) authentication. This flaw only affected users who haveenabled Hadoop's Kerberos security features. (CVE-2013-2192)It was discovered that the Spring OXM wrapper did not expose any propertyfor disabling entity resolution when using the JAXB unmarshaller. A remoteattacker could use this flaw to conduct XML External Entity (XXE) attackson web sites, and read files in the context of the user running theapplication server. The patch for this flaw disables external entityprocessing by default, and provides a configuration directive to re-enableit. (CVE-2013-4152)It was found that the Spring MVC SourceHttpMessageConverter enabled entityresolution by default. A remote attacker could use this flaw to conduct XXEattacks on web sites, and read files in the context of the user running theapplication server. The patch for this flaw disables external entityprocessing by default, and introduces a property to re-enable it.(CVE-2013-6429)The Spring JavaScript escape method insufficiently escaped some characters.Applications using this method to escape user-supplied content, which wouldbe rendered in HTML5 documents, could be exposed to cross-site scripting(XSS) flaws. (CVE-2013-6430)A denial of service flaw was found in the way Apache Commons FileUploadhandled small-sized buffers used by MultipartStream. A remote attackercould use this flaw to create a malformed Content-Type header for amultipart request, causing Apache Commons FileUpload to enter an infiniteloop when processing such an incoming request. (CVE-2014-0050)It was found that fixes for the CVE-2013-4152 and CVE-2013-6429 XXE issuesin Spring were incomplete. Spring MVC processed user-provided XML andneither disabled XML external entities nor provided an option to disablethem, possibly allowing a remote attacker to conduct XXE attacks.(CVE-2014-0054)A cross-site scripting (XSS) flaw was found in the Spring Framework whenusing Spring MVC. When the action was not specified in a Spring form, theaction field would be populated with the requested URI, allowing anattacker to inject malicious content into the form. (CVE-2014-1904)The HawtJNI Library class wrote native libraries to a predictable file namein /tmp when the native libraries were bundled in a JAR file, and no customlibrary path was specified. A local attacker could overwrite these nativelibraries with malicious versions during the window between when HawtJNIwrites them and when they are executed. (CVE-2013-2035)An information disclosure flaw was found in the way Apache Zookeeper storedthe password of an administrative user in the log files. A local user withaccess to these log files could use the exposed sensitive information togain administrative access to an application using Apache Zookeeper.(CVE-2014-0085)The CVE-2013-6430 issue was discovered by Jon Passki of Coverity SRL andArun Neelicattu of the Red Hat Security Response Team, the CVE-2013-2035issue was discovered by Florian Weimer of the Red Hat Product SecurityTeam, and the CVE-2014-0085 issue was discovered by Graeme Colman ofRed Hat.All users of Red Hat JBoss A-MQ 6.0.0 as provided from the Red Hat CustomerPortal are advised to apply this update.