The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.

fix for CVE-2015-6524 (rhbz#1257246,1257248)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions 5.x of Apache ActiveMQ prior to 5.10.1 are affected by the following vulnerabilities :

 - An unauthenticated, remote attacker can crash the broker listener by sending a packet to the same port that a message consumer or product connects to, resulting in a denial of service condition. (CVE-2014-3576)
 - An XXE (Xml eXternal Entity) injection flaw related to XPath selectors exists that is triggered during the parsing of XML data. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can disclose the contents of arbitrary files. (CVE-2014-3600)
 - Two flaws exists that allow a reflected cross-site scripting (XSS) attack. The first flaw exists because the 'connection.jsp' script does not validate input to the 'connectionID' parameter before returning it to users. The second flaw exists because the 'browse.jsp' script does not validate input to the 'JMSDestination' GET parameter before returning it to users. Either of these vulnerabiltiies may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.  (CVE-2014-8110)
 - A flaw exists that allows a stored cross-site scripting (XSS) attack. This flaw exists because the 'createDestination.action' script does not validate input to the 'JMSDestination' parameter before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2010-0684)
 - A flaw exists in LDAPLoginModule in Java Authentication and Authorization Service (JAAS) that is triggered when handling an authentication attempt that contains an invalid password. This authentication attempt will be considered successful, which can allow a remote attacker to bypass authentication mechanisms. This flaw is also triggered during the handling of an authentication attempt that contains a wildcard operator in place of a username. This may allow a remote attacker to bypass authentication mechanisms (CVE-2014-3612) and can allow remote attackers to obtain credentials via a brute force attack. (CVE-2015-6524)

ID	Name	Product	Family	Severity
89280	Fedora 22 : activemq-5.6.0-12.fc22 (2015-701a1e1a5f)	Nessus	Fedora Local Security Checks	medium
8961	Apache ActiveMQ 5.x < 5.10.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	critical
86265	Fedora 23 : activemq-5.6.0-12.fc23 (2015-5622085024)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2015-6524

medium

Tenable Plugins

medium

critical

medium