(RHSA-2013:1862) Important: Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update

Fuse ESB Enterprise is an integration platform based on Apache ServiceMix.
Fuse MQ Enterprise, based on Apache ActiveMQ, is a standards compliant
messaging system that is tailored for use in mission critical applications.

This release of Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P1 is an update
to Fuse ESB Enterprise 7.1.0 and Fuse MQ Enterprise 7.1.0. It includes bug
fixes. Refer to the readme file included with the patch files for
information about the bug fixes.

The following security issues are also fixed with this release:

A flaw was found in the logging performed during deserialization of the
BrokerFactory class in Apache OpenJPA. A remote attacker able to supply a
serialized instance of the BrokerFactory class, which will be deserialized
on a server, could use this flaw to write an executable file to the
server’s file system. (CVE-2013-1768)

Restlet applications, which used ObjectRepresentation to map HTTP request
data directly to an object, deserialized arbitrary user-provided XML using
XMLDecoder. XMLDecoder deserialized an attacker-provided definition of a
class and executed its methods. A remote attacker could use this flaw to
perform remote code execution in the context of the server running the
Restlet application. (CVE-2013-4221)

A flaw was found in the way Restlet handled deserialization.
Restlet applications, which used ObjectRepresentation to map HTTP request
data directly to an object, deserialized arbitrary user-provided serialized
data. A remote attacker could use this flaw to trigger the execution of the
deserialization methods in any serializable class deployed on the server.
This could lead to a variety of security impacts depending on the
deserialization logic of these classes. (CVE-2013-4271)

A flaw was found in Apache Camel’s parsing of the FILE_NAME header.
A remote attacker able to submit messages to a Camel route, which would
write the provided message to a file, could provide expression language
(EL) expressions in the FILE_NAME header, which would be evaluated on the
server. This could lead to arbitrary remote code execution in the context
of the Camel server process. (CVE-2013-4330)

Multiple stored cross-site scripting (XSS) flaws were found in the Fuse
Management Console. A remote attacker could use this flaw to perform an XSS
attack against other users of the Fuse Management Console. (CVE-2013-4372)

The CVE-2013-4271 issue was discovered by David Jorm of the Red Hat
Security Response Team.

All users of Fuse ESB Enterprise/MQ Enterprise 7.1.0 as provided from the
Red Hat Customer Portal are advised to upgrade to Fuse ESB Enterprise/MQ
Enterprise 7.1.0 R1 P1.