Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster, which allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by leveraging knowledge of a cluster-username.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:0529 advisory.

    Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a next-generation     IT infrastructure for enterprise computing. MRG offers increased     performance, reliability, interoperability, and faster computing for     enterprise customers.

    MRG Messaging is a high-speed reliable messaging distribution for Linux     based on AMQP (Advanced Message Queuing Protocol), an open protocol     standard for enterprise messaging that is designed to make mission critical     messaging widely available as a standard service, and to make enterprise     messaging interoperable across platforms, programming languages, and     vendors. MRG Messaging includes an AMQP 0-10 messaging broker; AMQP 0-10     client libraries for C++, Java JMS, and Python; as well as persistence     libraries and management tools.

    It was found that Qpid accepted any password or SASL mechanism, provided     the remote user knew a valid cluster username. This could give a remote     attacker unauthorized access to the cluster, exposing cluster messages and     internal Qpid/MRG configurations. (CVE-2011-3620)

    Note: If you are using an ACL, the cluster-username must be allowed to     publish to the qpid.cluster-credentials exchange. For example, if your     cluster-username is foo, in your ACL file:

    acl allow foo@QPID publish exchange name=qpid.cluster-credentials

    The CVE-2011-3620 fix changes the cluster initialization protocol. As such,     the cluster with all new version brokers must be restarted for the changes     to take effect. Refer below for details.

    These updated packages provide numerous enhancements and bug fixes for the     Messaging component of MRG. Space precludes documenting all of these     changes in this advisory. Documentation for these changes will be available     shortly in the Technical Notes document linked to in the References     section.

    All users of the Messaging capabilities of Red Hat Enterprise MRG 2.1 are     advised to upgrade to these updated packages, which resolve the issues and     add the enhancements noted in the Red Hat Enterprise MRG 2 Technical Notes.
    After installing the updated packages, stop the cluster by either running     service qpidd stop on all nodes, or qpid-cluster --all-stop on any one     of the cluster nodes. Once stopped, restart the cluster with     service qpidd start on all nodes for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:0528 advisory.

    Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a next-generation     IT infrastructure for enterprise computing. MRG offers increased     performance, reliability, interoperability, and faster computing for     enterprise customers.

    MRG Messaging is a high-speed reliable messaging distribution for Linux     based on AMQP (Advanced Message Queuing Protocol), an open protocol     standard for enterprise messaging that is designed to make mission critical     messaging widely available as a standard service, and to make enterprise     messaging interoperable across platforms, programming languages, and     vendors. MRG Messaging includes an AMQP 0-10 messaging broker; AMQP 0-10     client libraries for C++, Java JMS, and Python; as well as persistence     libraries and management tools.

    It was found that Qpid accepted any password or SASL mechanism, provided     the remote user knew a valid cluster username. This could give a remote     attacker unauthorized access to the cluster, exposing cluster messages and     internal Qpid/MRG configurations. (CVE-2011-3620)

    Note: If you are using an ACL, the cluster-username must be allowed to     publish to the qpid.cluster-credentials exchange. For example, if your     cluster-username is foo, in your ACL file:

    acl allow foo@QPID publish exchange name=qpid.cluster-credentials

    The CVE-2011-3620 fix changes the cluster initialization protocol. As such,     the cluster with all new version brokers must be restarted for the changes     to take effect. Refer below for details.

    These updated packages provide numerous enhancements and bug fixes for the     Messaging component of MRG. Space precludes documenting all of these     changes in this advisory. Documentation for these changes will be available     shortly in the Technical Notes document linked to in the References     section.

    All users of the Messaging capabilities of Red Hat Enterprise MRG 2.1 are     advised to upgrade to these updated packages, which resolve the issues and     add the enhancements noted in the Red Hat Enterprise MRG 2 Technical Notes.
    After installing the updated packages, stop the cluster by either running     service qpidd stop on all nodes, or qpid-cluster --all-stop on any one     of the cluster nodes. Once stopped, restart the cluster with     service qpidd start on all nodes for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
76643	RHEL 5 : Red Hat Enterprise MRG Messaging 2.1 (RHSA-2012:0529)	Nessus	Red Hat Local Security Checks	critical
76642	RHEL 6 : Red Hat Enterprise MRG Messaging 2.1 (RHSA-2012:0528)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2011-3620

critical

Tenable Plugins

critical

critical