copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
 
Search this site

 
On this site

 > HOME
 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login





 

ESB-2016.0729 - [Debian] activemq: Execute arbitrary code/commands - Remote/unauthenticated

Date: 21 March 2016
References: ESB-2016.0685  ESB-2016.0755  

Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2016.0729
                         activemq security update
                               21 March 2016

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           activemq
Publisher:         Debian
Operating System:  Debian GNU/Linux 7
                   Debian GNU/Linux 8
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2015-5254  

Reference:         ESB-2016.0685

Original Bulletin: 
   http://www.debian.org/security/2016/dsa-3524

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3524-1                   security@debian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
March 20, 2016                        https://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : activemq
CVE ID         : CVE-2015-5254

It was discovered that the ActiveMQ Java message broker performs unsafe
deserialisation. For additional information, please refer to the
upstream advisory at
http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt

For the oldstable distribution (wheezy), this problem has been fixed
in version 5.6.0+dfsg-1+deb7u2.

For the stable distribution (jessie), this problem has been fixed in
version 5.6.0+dfsg1-4+deb8u2.

For the testing distribution (stretch), this problem has been fixed
in version 5.13.2+dfsg-1.

For the unstable distribution (sid), this problem has been fixed in
version 5.13.2+dfsg-1.

We recommend that you upgrade your activemq packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJW7yV6AAoJEBDCk7bDfE42RUQQALUyopkT0uMzAybeh3tpI+si
l/PK7oyQLjw8t5Fr9njYigMEQ+uOHJEme4z9VI6lJoCWGGIycmNc5Ns3aivGMH24
W/yKjWD4jhk+Yoat4gnRmYKYjEz6Mw+Iu73YidNrMXlF1tZj5H4p55nAM9odbC//
1TXJPfaMSjGQMuzjKJobNmmGPTwfR0FIp6HeyJTpmutxER2tvDS73OyMMwOvqYld
Bg8r2dAmsKO4RCcMivmLlJoM/a7XrHxg33BVG254EXidyz8YHJePZfzWyi0vp2Vs
LO+R3hWax1V6/GBMwdnR8ly887O0v1sd0HTUxPf1EdKUw7znVOJuG3PHDMiQ1T0d
oxIENV2vKrpGtGcGyLyxcrpjYbQt1cPKfGkpiaeGsIST52/WDoMh2MXNB7nRv4zc
fNNrw1LtgSUFQh5FA6o6ORhu7TWUBUreWT/NbL7tjn/qP8tNSfkUMb1yqS20XZsO
QXuRCsp4HDBA/ZXL1nyDpsaMXnhnbqbtVbpON1xCXyf03XDK6YIlpC2wAlbwed3+
7LaDVTX4QK36SprtLUfJsiTWuAtG2KWI2vfcAVvR1UJ//UqTDZENDYcXEq094QPN
RyOzXgqKyLoTfCaD7Rv81Fp4MwlOHE7Mrpnx5AVxmYx1BI0xzEbVQQzNMAuh2F5A
I79waRHaaZQvDwpkFpwh
=lQ0y
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVu9g436ZAP0PgtI9AQIrtRAAw7kvmKbQH5UylrfiOz2iKT0k5QxtvDbo
6N7a8ib+mJyQFzFM29uLMOZdLcKb+E2vDS5JvVEi4JVH6d0iWL5r/vW3vVVbqCQ6
7EfULoBeOlwYRdzMM43c8SvS8MB3OUlPi7INS6fEweC9CSH8h09hR7NY5GBkj29w
qq+IlMMtQ4geJRLVoOOy7Alk5CIyQlKAhqBY91hhHOsYPak4jhk9Fvc8h7Y63WGT
gCrahJhyHm+BIpxhVFqM61TFzKBAYWGI8PzHpgJnJB4QMdMafskWKdiY7aTsKog+
falQBEmY3XUudI1L54/GrCXHF7bvM02MgcZUKjQ/zYzsssR9Sn10CgFbd5jg6X1c
Cfwb0J+itBjuPBMSHIs8IjUniiznTAxZtHli2qdwTzIEW3huWCjXcY3m+MiurlG2
yNKF0vgy3WvPfMVIgET3aOXoy0UKBAUfW1PO2UMpeGU8Kr4sO/K0dlXDyPgs4ZFR
dsh0+IYP2wWRywt2rQdtHAIndU7YF1zAMlAqzss++MkIbOdClo2lgeuH24sCL54j
iJ7iuwN12UrAkN63ga8pZU0g4u/9yi0ABbrN8XzmiNreNBbbMxBO6MhPAaB0Z/Qs
CjP8MTr3lkLBHeli9pHzPzstBmp+0cu8xPabL16ehqLYIvUol7dkaI3RuzWKw3wz
boeNOerJ0e0=
=/lIb
-----END PGP SIGNATURE-----