copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
 
Search this site

 
On this site

 > HOME
 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login





 

ESB-2016.0687 - [Win][UNIX/Linux] Apache ActiveMQ: Multiple vulnerabilities

Date: 15 March 2016
References: ESB-2016.1730  

Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2016.0687
     Multiple vulnerabilities have been identified in Apache ActiveMQ
                               15 March 2016

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Apache ActiveMQ
Publisher:         The Apache Software Foundation
Operating System:  UNIX variants (UNIX, Linux, OSX)
                   Windows
Impact/Access:     Cross-site Scripting           -- Remote with User Interaction
                   Provide Misleading Information -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2016-0782 CVE-2016-0734 

Original Bulletin: 
   http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt
   http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt

Comment: This bulletin contains two (2) The Apache Software Foundation 
         security advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

CVE-2016-0782: ActiveMQ Web Console - Cross-Site Scripting

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:

Apache ActiveMQ 5.0.0 - 5.13.1

Description:

Several instances of cross-site scripting vulnerabilities were identified to 
be present in the web based administration console as well as the ability to 
trigger a Java memory dump into an arbitrary folder. The root cause of these 
issues are improper user data output validation and incorrect permissions 
configured on Jolokia.

Mitigation:

Upgrade to Apache ActiveMQ 5.11.4, 5.12.3, or 5.13.2

Credit:

This issue was discovered by Vladimir Ivanov (Positive Technologies)

- ---------------

CVE-2016-0734: ActiveMQ Web Console - Clickjacking

Severity: Important

Vendor:

The Apache Software Foundation

Versions Affected:

Apache ActiveMQ 5.0.0 - 5.13.1

Description:

The web based administration console does not set the X-Frame-Options header 
in HTTP responses. This allows the console to be embedded in a frame or iframe
which could then be used to cause a user to perform an unintended action in 
the console.

Mitigation:

Upgrade to Apache ActiveMQ 5.13.2

Credit:

This issue was discovered by Michael Furman

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVudamH6ZAP0PgtI9AQL3ohAAnbz+M3Nzw4IJuXVXq0mXPm+ch8WLl/0i
X8fd/ckGDqp+3S4HujjIPiZtqGKIqeX9n4pr4XnURdDFKVXv8lR74BXj8RcHdp3p
TNM1IF5RRyasKAR6p1PEBvOeP/d3ObtIHcb8X6iT4YIh/T0BCy1k5JMjeqnicdkV
C8I/iCLNsClaonY0M2gk07b6CsCVeCOLYuQyE0b09bD9sLio6RVHuOBmp8lA6UnU
aT9MM+hvcYmra916AisFq7F79+LexuGvTqYjfz9f/xhDnj1m+nO2D5VfvgWasC54
SNJGNcDFQNSbMMsif57y8QByhrUdhPP9eicXFi40anU5INsC9v44L6O9roPetKLG
27kHVpvQunQsSFplxJqoL2PAqjcK4cL8v2gFLKpUZ9pzeB17vuwU+zR09kHQL8fn
yJ6rkm3KZYDBEAuPpdEIdVKB7YXJebhlrrU4T6yib16p90U9G2tWnXorcoL4Vfgc
KxNfrfiSXBBl14kCxpYLJxrGp4jWh+F0Bm751eXZjHxwNEWUgVOmvgogD4+W4Krq
jbXwO1fLUE7aQgbiTrEXW8tYvoTp7iFT/TUL5FuiWHG93vEBk6g1jyEGfPbeaPmC
STgnpVcccWmJXCQmMhLMqxF4uZ3SgYmsE0gIFBYvFD8WYkSDa6OPlCVqiyFzGyEF
3xKItk3TX38=
=2EMH
-----END PGP SIGNATURE-----