Bug 1339318 (CVE-2016-3088)

Summary:	CVE-2016-3088 activemq: Fileserver web application vulnerability allowing RCE
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abhgupta, aileenc, ccoleman, chazlett, dmcphers, gvarsami, hghasemb, java-sig-commits, jcoleman, jgoulding, jialiu, joelsmith, jokerman, kconner, kseifried, ldimaggi, lmeyer, mmccomas, nwallace, pavelp, rwagner, sfowler, soa-p-jira, s, tazz, tcunning, tdawson, tiwillia, tkirby
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
See Also:	https://issues.redhat.com/browse/ENTESB-9519 https://issues.redhat.com/browse/ENTMQ-1730
Whiteboard:
Fixed In Version:	apache activemq 5.14.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-04-14 02:45:33 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1339319, 1339320
Bug Blocks:	1339322

Description Adam Mariš 2016-05-24 16:49:50 UTC

Multiple vulnerabilities have been identified in the Apache ActiveMQ Fileserver web application. These are similar to those reported in CVE-2015-1830 and can allow attackers to replace web application files with malicious code and perform remote code execution on the system.

Mitigation:

Users are advised to use other FTP and HTTP based file servers for transferring blob messages. Fileserver web application SHOULD NOT be used in older version of the broker and it should be disabled (it has been disabled by default since 5.12.0). This can be done by removing (commenting out) the following lines from conf\jetty.xml file

<bean class="org.eclipse.jetty.webapp.WebAppContext">
    <property name="contextPath" value="/fileserver" />
    <property name="resourceBase" value="${activemq.home}/webapps/fileserver" />
    <property name="logUrlOnStart" value="true" />
    <property name="parentLoaderPriority" value="true" />
</bean>

External Reference:

http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt

Comment 8 Jonathan Christison 2019-10-10 16:37:35 UTC

Amended RHSA-2015:1176-04 to reflect this CVE being fixed at that time

Comment 12 Chess Hazlett 2019-10-11 16:07:26 UTC

Statement:

Red Hat JBoss A-MQ 6.3 , Red Hat JBoss Fuse 6.3, and Red Hat JBoss Fuse Service Works 6.0.0 do not provide the vulnerable component and are not affected by this flaw. Red Hat JBoss A-MQ 6.2.1 and Red Hat JBoss Fuse 6.2.1 disable the vulnerable component and as such are not vulnerable to this flaw. The fileserver component was first disabled in A-MQ 6.2.0 and Fuse 6.2.0. Users of older, unsupported versions of these products are strongly advised to observe the mitigation provided on this page.