InvokerTransformer code execution during deserialisation
CVE: CVE-2015-7501
Component: apache-commons-collections
CWE: CWE-284
Severity: Critical
Release date: 2015-11-06T00:00:00+00:00

It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.

Statement: This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata,
relevant to your system have been applied.

For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied. Also, make sure to back up any
modified configuration files, deployments, and all user data.
After applying the update, restart the instance of Red Hat JBoss Enterprise
Application Platform for the changes to take effect.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata 
relevant to your system have been applied.

See the OpenShift Enterprise 2.2 Release Notes, which will be updated 
shortly for release 2.2.10, for important instructions on how to fully 
apply this asynchronous errata update:

https://access.redhat.com/documentation/en-US/OpenShift_Enterprise/2/html-single/2.2_Release_Notes/index.html#chap-Asynchronous_Errata_Updates

This update is available via the Red Hat Network. Details on how to use 
the Red Hat Network to apply this update are available at 
https://access.redhat.com/articles/11258.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing Red Hat JBoss BRMS installation (including its databases,
applications, configuration files, and so on).

Note that it is recommended to halt the Red Hat JBoss BRMS server by
stopping the JBoss Application Server process before installing this
update, and then after installing the update, restart the Red Hat JBoss
BRMS server by starting the JBoss Application Server process.
The References section of this erratum contains a download link (you must
log in to download the update).
The References section of this erratum contains a download link (you must
log in to download the updates). Before applying the updates, back up your
existing installation, including all applications, configuration files,
databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application
Server process before installing this update, and then after installing
the update, restart the server by starting the JBoss Application Server
process.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing installation, including all applications, configuration files,
databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application
Server process before installing this update, and then after installing
the update, restart the server by starting the JBoss Application Server
process.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing Red Hat JBoss BRMS installation (including its databases,
applications, configuration files, and so on).

Note that it is recommended to halt the Red Hat JBoss BRMS server by
stopping the JBoss Application Server process before installing this
update, and then after installing the update, restart the Red Hat JBoss
BRMS server by starting the JBoss Application Server process.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing installation, including all applications, configuration files,
databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application
Server process before installing this update, and then after installing the
update, restart the server by starting the JBoss Application Server
process.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss Data Grid installation.
The References section of this erratum contains a download link (you must
log in to download the updates). Before applying the updates, back up your
existing installation, including all applications, configuration files,
databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application
Server process before installing this update, and then after installing
the update, restart the server by starting the JBoss Application Server
process.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
The References section of this erratum contains a download link (you must
log in to download the update).
The References section of this erratum contains a download link (you must
log in to download the updates). Before applying the updates, back up your
existing installation, including all applications, configuration files,
databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application
Server process before installing this update, and then after installing
the update, restart the server by starting the JBoss Application Server
process.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss Operations Network installation (including its databases,
applications, configuration files, the JBoss Operations Network server's
file system directory, and so on).

Note: This update provides fixes for the server, agent, and core GUI
components of Red Hat JBoss Operations Network. It is recommended to apply
all the patches provided by this update.
This is a server patch that contains a single fix and should not be mixed
with other server patches. If you already have a server patch, please
contact Red Hat Global Support Services for compatibility assessment.

You must shutdown the JBoss ON server prior to applying this patch.

This patch must be applied to each JBoss ON server in a high-availability
(HA) environment. You can apply the patch to each server individually so
that only one server is down at a time.

To install the patch:
    1.  Stop the JBoss ON server.
    2.  Backup and remove the following files:

            <RHQ_SERVER_HOME>/jbossas/modules/system/layers/base/org/apache/commons/collections/main/commons-collections-3.2.1-redhat-2.jar
            <RHQ_SERVER_HOME>/jbossas/modules/system/layers/base/org/apache/commons/collections/main/module.xml
            <RHQ_SERVER_HOME>/modules/org/rhq/server-startup/main/deployments/rhq.ear/lib/commons-collections-3.2.1.jar
            <RHQ_SERVER_HOME>/modules/org/rhq/server-startup/main/deployments/rhq.ear/rhq-portal.war/WEB-INF/lib/commons-collections-3.2.1.jar
            <RHQ_SERVER_HOME>/modules/org/rhq/server-startup/main/deployments/rhq.ear/rhq-content_http.war/WEB-INF/lib/commons-collections-3.2.1.jar

    3.  Extract the patch archive to the JBoss ON server's home directory.

        For example:
            unzip -od "${RHQ_SERVER_HOME}" /tmp/BZ1282545.zip

        Be sure to replace any existing files if prompted.
    4.  Start the JBoss ON server.

    Repeat the steps for any remaining JBoss ON servers in a HA environment.

    To uninstall the patch:
    1.  Stop the JBoss ON server.
    2.  Remove the updated files:

            <RHQ_SERVER_HOME>/jbossas/modules/system/layers/base/org/apache/commons/collections/main/commons-collections-3.2.1.redhat-3-bz-1281964.jar
            <RHQ_SERVER_HOME>/jbossas/modules/system/layers/base/org/apache/commons/collections/main/module.xml
            <RHQ_SERVER_HOME>/modules/org/rhq/server-startup/main/deployments/rhq.ear/lib/commons-collections-3.2.1.redhat-3-bz-1281964.jar
            <RHQ_SERVER_HOME>/modules/org/rhq/server-startup/main/deployments/rhq.ear/rhq-portal.war/WEB-INF/lib/commons-collections-3.2.1.redhat-3-bz-1281964.jar
            <RHQ_SERVER_HOME>/modules/org/rhq/server-startup/main/deployments/rhq.ear/rhq-content_http.war/WEB-INF/lib/commons-collections-3.2.1.redhat-3-bz-1281964.jar

    3.  Restore the following files from the backup created prior to applying this patch:

            <RHQ_SERVER_HOME>/jbossas/modules/system/layers/base/org/apache/commons/collections/main/commons-collections-3.2.1-redhat-2.jar
            <RHQ_SERVER_HOME>/jbossas/modules/system/layers/base/org/apache/commons/collections/main/module.xml
            <RHQ_SERVER_HOME>/modules/org/rhq/server-startup/main/deployments/rhq.ear/lib/commons-collections-3.2.1.jar
            <RHQ_SERVER_HOME>/modules/org/rhq/server-startup/main/deployments/rhq.ear/rhq-portal.war/WEB-INF/lib/commons-collections-3.2.1.jar
            <RHQ_SERVER_HOME>/modules/org/rhq/server-startup/main/deployments/rhq.ear/rhq-content_http.war/WEB-INF/lib/commons-collections-3.2.1.jar

    4.  Start the JBoss ON server.

    Repeat the steps for any remaining JBoss ON servers in a HA environment.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss Operations Network installation (including its databases,
applications, configuration files, the JBoss Operations Network server's
file system directory, and so on).

Refer to the JBoss Operations Network 3.3.5 Release Notes for
installation information.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up all
applications deployed on JBoss Enterprise Portal Platform, along with all
databases, database settings, and customized configuration files.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing Red Hat JBoss SOA Platform installation (including its databases,
applications, configuration files, and so on).

Note that it is recommended to halt the Red Hat JBoss SOA Platform server
by stopping the JBoss Application Server process before installing this
update, and then after installing the update, restart the Red Hat JBoss SOA
Platform server by starting the JBoss Application Server process.
Before applying this update, make sure all previously released errata
relevant to your system have been applied, and back up your existing Red
Hat JBoss Web Server installation (including all applications and
configuration files).

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258