(RHSA-2013:1410) Important: Red Hat JBoss Fuse/A-MQ 6.0.0 patch 4

Red Hat JBoss Fuse 6.0.0, based on Apache ServiceMix, provides an
integration platform. Red Hat JBoss A-MQ 6.0.0, based on Apache ActiveMQ,
is a standards compliant messaging system that is tailored for use in
mission critical applications.

Red Hat JBoss Fuse/A-MQ 6.0.0 patch 4 is an update to Red Hat JBoss Fuse
6.0.0 and Red Hat JBoss A-MQ 6.0.0. This update addresses the following
security issues:

Restlet applications which use ObjectRepresentation to map HTTP request
data directly to an object deserialize arbitrary user-provided XML using
XMLDecoder. It was found that XMLDecoder deserialized an attacker-provided
definition of a class and executed its methods. A remote attacker could use
this flaw to perform arbitrary remote code execution in the context of the
server running the Restlet application. (CVE-2013-4221)

A flaw was found in the way Restlet handled deserialization. Restlet
applications which use ObjectRepresentation to map HTTP request data
directly to an object deserialize arbitrary user-provided serialized
data. A remote attacker could use this flaw to trigger the execution of the
deserialization methods in any serializable class deployed on the server.
This could lead to a variety of security impacts depending on the
deserialization logic of these classes. (CVE-2013-4271)

A flaw was found in Apache Camel’s parsing of the FILE_NAME header. A
remote attacker able to submit messages to a Camel route, which would write
the provided message to a file, could provide expression language (EL)
expressions in the FILE_NAME header, which would be evaluated on the
server. This could lead to arbitrary remote code execution in the context
of the Camel server process. (CVE-2013-4330)

The CVE-2013-4271 issue was discovered by David Jorm of the Red Hat
Security Response Team.

This update also corrected a problem with installing JBoss Fuse 6.0.0 patch
3. When the pax-url-maven-commons bundle was installed in the container,
the installation would fail with a null pointer error. With this update,
the installation does not fail.

All users of Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ 6.0.0 as
provided from the Red Hat Customer Portal are advised to apply this patch.