Detections
Analytics
Apache ActiveMQ 5.x < 5.10.1 / 5.11.0 Multiple Vulnerabilities
high Nessus Plugin ID 81374
Language:
Synopsis
The remote host has a web application installed that is affected by multiple vulnerabilities.Description
The version of Apache ActiveMQ running on the remote host is 5.x prior to 5.10.1 / 5.11.0. It is, therefore, potentially affected by multiple vulnerabilities :- An unauthenticated, remote attacker can crash the broker listener by sending a packet to the same port that a message consumer or product connects to, resulting in a denial of service condition. (CVE-2014-3576)
- An XML external entity (XXE) injection vulnerability exists that is related to XPath selectors. A remote attacker can exploit this, via specially crafted XML data, to disclose the contents of arbitrary files.
(CVE-2014-3600)
- A flaw exists in the LDAPLoginModule of the Java Authentication and Authorization Service (JAAS) which can be triggered by the use of wildcard operators instead of a username or by invalid passwords. A remote attacker can exploit this to bypass authentication.
(CVE-2014-3612)
- Multiple cross-site scripting (XSS) vulnerabilities exist in the web administrative console. (CVE-2014-8110)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to version 5.10.1 / 5.11.0 or later.See Also
http://www.nessus.org/u?c8309341
Plugin Details
Severity: High
ID: 81374
File Name: activemq_5_10_1.nasl
Version: 1.18
Type: combined
Agent: unix
Family: CGI abuses
Published: 2/16/2015
Updated: 6/6/2024
Configuration: Enable thorough checks
Supported Sensors: Nessus Agent, Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2014-3612
Vulnerability Information
CPE: cpe:/a:apache:activemq
Required KB Items: installed_sw/Apache ActiveMQ
Exploit Ease: No known exploits are available
Patch Publication Date: 1/22/2015
Vulnerability Publication Date: 4/6/2010
Reference Information
CVE: CVE-2014-3576, CVE-2014-3600, CVE-2014-3612, CVE-2014-8110