Bug 587417 (CVE-2010-1587)

Summary:	CVE-2010-1587 ActiveMQ JSP source disclosure
Product:	[Other] Security Response	Reporter:	Josh Bressers <bressers>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	djorm, ldimaggi, mschoene
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-10-06 04:10:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2010-04-29 20:42:21 UTC

The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and
5.4.x before 5.4.0 allows remote attackers to read JSP source code via
a // (slash slash) initial substring in a URI for (1) admin/index.jsp,
(2) admin/queues.jsp, or (3) admin/topics.jsp.

http://www.securityfocus.com/archive/1/archive/1/510896/100/0/threaded
https://issues.apache.org/activemq/browse/AMQ-2700
http://www.vupen.com/english/advisories/2010/0979

Comment 2 David Jorm 2011-10-06 04:10:59 UTC

Statement:

Not vulnerable. Apache ActiveMQ is not shipped with any supported Red Hat products.