Apache ActiveMQ up to 5.10.0 weak authentication [CVE-2014-3612] : 8/25/2015 1:47:49 AM
 | This set of templates helps you define your app feature roadmap, now and over time. From our sponsors  |
| Vulnerability Advisories |
| Vulnerabilities of scip VulDB |
Apache ActiveMQ up to 5.10.0 weak authentication [CVE-2014-3612]
8/23/2015 7:00:00 PM
General
scipID: 77399
Affected: Apache ActiveMQ up to 5.10.0
Published: 08/24/2015
Risk: critical
Created: 08/25/2015
Entry: 69.4% complete
Summary
A vulnerability was found in Apache ActiveMQ up to 5.10.0. It has been rated as critical. This issue affects an unknown function of the component LDAPLoginModule/Java Authentication/Authorization Service. The manipulation with an unknown input leads to a weak authentication vulnerability. Impacted is confidentiality, integrity, and availability.
The weakness was shared 08/24/2015. The identification of this vulnerability is CVE-2014-3612. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.
The vulnerability scanner Nessus provides a plugin with the ID 81374 (Apache ActiveMQ 5.x < 5.10.1 / 5.11.0 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment. It is assigned to the family CGI abuses.
Upgrading to version 5.10.1 eliminates this vulnerability. See 74172 and 77247 for similar entries.CVSS
Base Score: 6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P) [?]
Temp Score: 5.9 (CVSS2#E:ND/RL:OF/RC:ND) [?]
CPE
Exploiting
Class: Weak authentication
Local: No
Remote: Yes
Availability: No
Nessus ID: 81374
Nessus Name: Apache ActiveMQ 5.x < 5.10.1 / 5.11.0 Multiple Vulnerabilities
Nessus File: activemq_5_10_1.nasl
Nessus Family: CGI abuses
Countermeasures
Recommended: Upgrade
Status: Official fix
0-Day Time: 0 days since found
Upgrade: ActiveMQ 5.10.1
Timeline
08/24/2015 | Advisory disclosed
08/25/2015 | VulDB entry created
08/25/2015 | VulDB entry updated
Sources
CVE: CVE-2014-3612 (mitre.org) (nvd.nist.org) (cvedetails.com)
You are receiving this email because you subscribed to this feed at feedmyinbox.com
If you no longer wish to receive these emails, you can unsubscribe from this feed, or manage all your subscriptions
