SB2015021204 - Multiple vulnerabilities in ActiveMQ

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2015021204

SB2015021204 - Multiple vulnerabilities in ActiveMQ

Published: February 12, 2015 Updated: January 15, 2021

Security Bulletin ID SB2015021204
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 33% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) XML External Entity injection (CVE-ID: CVE-2014-3600)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.


2) Improper Authentication (CVE-ID: CVE-2014-3612)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.


3) Cross-site scripting (CVE-ID: CVE-2014-8110)

Vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability is caused by an input validation error in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 when processing unspecified vectors. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


Remediation

Install update from vendor's website.

References