<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" id="owaParaStyle" style="display: none;">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body dir="ltr" fpstyle="1" aria-label="Message body" tabindex="0">
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper" style="font-family: Calibri,Arial,Helvetica,sans-serif; font-size: 12pt; color: #000000; margin: 0">
<div>Package: activemq</div>
<div>Version: 5.6.0+dfsg-1</div>
<div><br>
</div>
<div>Apache ActiveMQ as packaged for Debian seems to ship with an old XStream (1.4.2) library[1][2] which allows for instantiating arbitrary classes. This could be leveraged for system command execution as demonstrated against versions before 1.4.7.</div>
<div><br>
</div>
<div><br>
</div>
<div># dpkg -S /usr/share/activemq/lib/optional/xstream.jar</div>
<div>activemq: /usr/share/activemq/lib/optional/xstream.jar</div>
<div>#</div>
<div><br>
</div>
<div># dpkg -s activemq</div>
<div>Package: activemq</div>
<div>Status: install ok installed</div>
<div>Priority: optional</div>
<div>Section: java</div>
<div>Installed-Size: 217</div>
<div>Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org></div>
<div>Architecture: all</div>
<div>Version: 5.6.0+dfsg-1</div>
<div>Depends: adduser (>= 3.11), libactivemq-java (= 5.6.0+dfsg-1), openjdk-6-jre-headless | java6-runtime-headless</div>
<div>Conffiles:</div>
<div> /etc/default/activemq 3353e02e20e45a2224c1559f7e52e0a7</div>
<div> /etc/activemq/instances-available/main/log4j.properties 7a52b5daa7fba629b28bc9c05ccc3dc0</div>
<div> /etc/activemq/instances-available/main/activemq.xml 0d815a59ffa96e5978540ceee4623b56</div>
<div> /etc/init.d/activemq 8eb32df2af38fce26258548ae04c538b</div>
<div>Description: Java message broker - server</div>
<div> Apache ActiveMQ is a message broker built around Java Message Service (JMS)</div>
<div> API : allow sending messages between two or more clients in a loosely coupled,</div>
<div> reliable, and asynchronous way.</div>
<div> .</div>
<div> This message broker supports :</div>
<div> * JMS 1.1 and J2EE 1.4 with support for transient, persistent, transactional</div>
<div> and XA messaging</div>
<div> * Spring Framework, CXF and Axis integration</div>
<div> * pluggable transport protocols such as in-VM, TCP, SSL, NIO, UDP, multicast,</div>
<div> JGroups and JXTA</div>
<div> * persistence using JDBC along with journaling</div>
<div> * OpenWire (cross language wire protocol) and</div>
<div> Stomp (Streaming Text Orientated Messaging Protocol) protocols</div>
<div> .</div>
<div> This package contains a server installation of ActiveMQ.</div>
<div>Homepage: http://activemq.apache.org</div>
<div>#</div>
<div><br>
</div>
<div># unzip -p /usr/share/activemq/lib/optional/xstream.jar META-INF/maven/com.thoughtworks.xstream/xstream/pom.properties</div>
<div>#POM properties</div>
<div>#Mon May 28 22:20:08 UTC 2012</div>
<div>version=1.4.2</div>
<div>groupId=com.thoughtworks.xstream</div>
<div>debianVersion=debian</div>
<div>type=jar</div>
<div>classifier=</div>
<div>artifactId=xstream</div>
<div>#</div>
<div><br>
</div>
<div>[1] http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html</div>
<div>[2] http://xstream.codehaus.org/security.html</div>
<div>
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
<br>
</div>
</div>
</div>
</div>
</body>
</html>