Apache ActiveMQ CVE-2016-3088

Upgrade immediately to Apache ActiveMQ 5.14.0 or later, which removes the vulnerable Fileserver web application functionality according to the vendor advisory at http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt and commit thread at https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E. Red Hat customers should apply RHSA-2016-2036 for integrated products. If immediate upgrade is not feasible, disable the Fileserver web application by removing or commenting out the fileserver servlet mapping in the ActiveMQ web.xml configuration file, though this breaks legitimate file transfer functionality. Network segmentation to restrict ActiveMQ admin interface access to trusted management networks provides defense-in-depth but does not eliminate risk if attackers gain internal network access. Do not rely on authentication controls alone as the vulnerability affects unauthenticated endpoints. Given active exploitation and available weaponized exploits, workarounds should be considered temporary emergency measures only pending full upgrade.