ESB-2018.1864 - [Win][UNIX/Linux][RedHat] Red Hat JBoss Fuse/A-MQ: Access confidential data - Remote/unauthenticated 2018-06-27

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.1864
   Moderate: Red Hat JBoss Fuse/A-MQ 6.3 R8 security and bug fix update
                               27 June 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Red Hat JBoss Fuse/A-MQ
Publisher:         Red Hat
Operating System:  Red Hat
                   UNIX variants (UNIX, Linux, OSX)
                   Windows
Impact/Access:     Access Confidential Data -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-9159  

Original Bulletin: 
   https://access.redhat.com/errata/RHSA-2018:2020

Comment: This advisory references vulnerabilities in products which run on 
         platforms other than Red Hat. It is recommended that administrators
         running Red Hat JBoss Fuse/A-MQ check for an updated version of the
         software for their operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat JBoss Fuse/A-MQ 6.3 R8 security and bug fix update
Advisory ID:       RHSA-2018:2020-01
Product:           Red Hat JBoss Fuse
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:2020
Issue date:        2018-06-26
CVE Names:         CVE-2018-9159 
=====================================================================

1. Summary:

An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint,
flexible, open source enterprise service bus and integration platform. 

Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant
messaging system that is tailored for use in mission critical applications.

This patch is an update to Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ
6.3. It includes bug fixes and enhancements, which are documented in the
readme.txt file included with the patch files.

Security Fix(es):

* spark: Absolute and relative pathnames allow for unintended static file
disclosure (CVE-2018-9159)

3. Solution:

Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.

Installation instructions are located in the download section of the
customer portal.

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1563732 - CVE-2018-9159 spark: Absolute and relative pathnames allow for unintended static file disclosure

5. References:

https://access.redhat.com/security/cve/CVE-2018-9159
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse&downloadType=securityPatches&version=6.3
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches&product=jboss.amq.broker&version=6.3.0
https://access.redhat.com/documentation/en-us/red_hat_amq/6.3/
https://access.redhat.com/documentation/en-us/red_hat_fuse/6.3/

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBWzJsotzjgjWX9erEAQjJGQ//ToQYr/Mve7FE/UbTSSgrTzYg4CzRtau5
BYONy1MAf31DPl/VIlpDgkR19c26AGwGJzkCp50lbra5A3WEgg+WH3LRURjxhMLo
dDC538Tnu7eDV8H/DsnFpVlTL2La3sN/z7DwmUjvQzHEqXhFOEWWgNAS2I1S2MZv
XkCGnD41Hj/AX8dRJ5Lkc3iagzVoLfYetJct42Bu00BL/p1l7+B6vhwuzOEQOqXE
2REqWKcRCfjVHDy6UfQUeXx41OByiGZhLt1AVtpWqrzpAfYIAZbeQyr2N8KrpdKM
tPeIt5BFTmMm1aSthe00RMLrJlh3nIoCTFtB/0EXg4PZcQ9pVXqcc1mDFK4Au062
Kxe9b7VfiblwAyqKVx49ZZ6SiE7jmfqUncFWRG/K4GhHbrwJ+h3itU5JaJOGXUeA
6wir9gmCI/77C+bQ5GaLRL2rdaKrW2V+uo7p4KuuPaBNtdQBQLg020AU5Z3J6/5O
nkbWPnwgQTSy+IB+bOnmuxCbuQJRyE7Wr0skE5WpFfdHTU0kDK1Sv29u7vOFCrLq
JOw4fulPjb89s0awnUbTzaadO3s61Afm8Z5wYI6m4Ry5CJdbMn4k5XLOpttNAupV
JcRiDSR9HM2ygjHCwkXGVJ3No7zjC9ubX5TJrhgWx+srrTpWn7HVkpv4Ygt/PXrb
Z0EmE5XoGLA=
=VIJW
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWzLbXWaOgq3Tt24GAQggxxAAmp5nQYpWeqmj/e90SpzgQRdL1KhT0pVA
VaaXBshkchvvNWkDhpgODqTSDbBmS1nHONmHOKe2KkOpulFPGNYIjoPnHwXoxJ6p
H9daayopGtvjLh9tMdY+CwTKKmIZUnPL/aUAc094Ua0tUW7LpZ/PzfBTMdWLLnPM
GfJnqED/VpOGNyj57qehP6n+rgiwkr1R1w8TVf5DPIMuFnj7YkqkYgppKTugkDa+
0uJJSOg3vBxHIhB7FVslvxDtusWyA+h9mUfDFeipozfJrXSWgvjD8jcZj2iLncDv
2Yycn7iZgYmNT/mHb/uTe0opu8b8lCOj1fGScIvO0Y1SYwX++EXB0ocs42f83hrK
cxGxL0zpsbuXn+jWU9chUPI8YhGv7kPznA/tmYKLp6zGlzeMYvRzxpZ5D9KmZgKr
C5gT7GNhB3zEaF1/GUnvN+/HD9YSEDf5d3C1mRGti69IGzcTKhgA/n/7u9waJcw3
SB1DV52busivXr/xZENXIKbVDUS1WYBT4RbjCfEjHpmf0lKKqcihpsZIxopL+jyw
GvHhMkUhWToj/W36iNqaUyMoci4CD19fkUinoFmdBAP4fjQp55wweQd/d99m0cty
xbiSdZCBvyUVZxTDPlnEFjOCciGiprcvz+QI0NhVmWjs7w3vXBfDLO3xGjgwoGbn
7CgPUGpk7TI=
=/a0P
-----END PGP SIGNATURE-----

« Back to bulletins