The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0
    allows remote attackers to cause a denial of service (shutdown) via a shutdown command. (CVE-2014-3576)

The version of Oracle Business Intelligence Publisher running on the remote host is 11.1.1.7.x prior to 11.1.1.7.160119, 11.1.1.9.x prior to 11.1.1.9.160119, or 12.2.1.0.x prior to 12.2.1.0.160419. It is, therefore, affected by multiple vulnerabilities as noted in the April 2016 Critical Patch Update advisory. These vulnerabilities are as follows:

  - An unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle     Fusion Middleware which allows remote, authenticated users to affect confidentiality and integrity via     vectors related to Analytics Web General (CVE-2016-0468).

  - An unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle     Fusion Middleware which allows remote attackers to affect confidentiality and integrity via vectors     related to Analytics Scorecard (CVE-2016-0479).

  - The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0,     used by Oracle Business Intelligence Publisher, allows remote attackers to cause a denial of service     (shutdown) via a shutdown command (CVE-2014-3567).

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Novell NetIQ Sentinel server installed on the remote host is prior to 7.4.1. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in Apache ActiveMQ in the     processControlCommand() function within the file     broker/TransportConnection.java. An unauthenticated,     remote attacker can exploit this, via a specially     crafted packet, to cause a denial of service condition.
    (CVE-2014-3576)

  - A flaw exists in the XMLTooling library due to a failure     to properly handle integer conversion exceptions. An     unauthenticated, remote attacker can exploit this, via a     crafted SAML message, to cause a denial of service     condition. (CVE-2015-0851)

  - A remote code execution vulnerability exists due to     unsafe deserialize calls of unauthenticated Java objects     to the Apache Commons Collections (ACC) library. An     unauthenticated, remote attacker can exploit this, by     sending a specially crafted serialized Java object via     the RMI interface, to execute arbitrary code with the     privileges of the application.

Versions 5.x of Apache ActiveMQ prior to 5.10.1 are affected by the following vulnerabilities :

 - An unauthenticated, remote attacker can crash the broker listener by sending a packet to the same port that a message consumer or product connects to, resulting in a denial of service condition. (CVE-2014-3576)
 - An XXE (Xml eXternal Entity) injection flaw related to XPath selectors exists that is triggered during the parsing of XML data. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can disclose the contents of arbitrary files. (CVE-2014-3600)
 - Two flaws exists that allow a reflected cross-site scripting (XSS) attack. The first flaw exists because the 'connection.jsp' script does not validate input to the 'connectionID' parameter before returning it to users. The second flaw exists because the 'browse.jsp' script does not validate input to the 'JMSDestination' GET parameter before returning it to users. Either of these vulnerabiltiies may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.  (CVE-2014-8110)
 - A flaw exists that allows a stored cross-site scripting (XSS) attack. This flaw exists because the 'createDestination.action' script does not validate input to the 'JMSDestination' parameter before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2010-0684)
 - A flaw exists in LDAPLoginModule in Java Authentication and Authorization Service (JAAS) that is triggered when handling an authentication attempt that contains an invalid password. This authentication attempt will be considered successful, which can allow a remote attacker to bypass authentication mechanisms. This flaw is also triggered during the handling of an authentication attempt that contains a wildcard operator in place of a username. This may allow a remote attacker to bypass authentication mechanisms (CVE-2014-3612) and can allow remote attackers to obtain credentials via a brute force attack. (CVE-2015-6524)

It was discovered that the Apache ActiveMQ message broker is susceptible to denial of service through an undocumented, remote shutdown command.

The version of Apache ActiveMQ running on the remote host is 5.x prior to 5.10.1 / 5.11.0. It is, therefore, potentially affected by multiple vulnerabilities :

  - An unauthenticated, remote attacker can crash the broker     listener by sending a packet to the same port that a     message consumer or product connects to, resulting in a     denial of service condition. (CVE-2014-3576)

  - An XML external entity (XXE) injection vulnerability     exists that is related to XPath selectors. A remote     attacker can exploit this, via specially crafted XML     data, to disclose the contents of arbitrary files.
    (CVE-2014-3600)

  - A flaw exists in the LDAPLoginModule of the Java     Authentication and Authorization Service (JAAS) which     can be triggered by the use of wildcard operators     instead of a username or by invalid passwords. A remote     attacker can exploit this to bypass authentication.
    (CVE-2014-3612)

  - Multiple cross-site scripting (XSS) vulnerabilities     exist in the web administrative console. (CVE-2014-8110)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
409733	SCA: security update for org.apache.activemq:activemq-client (GHSA-3wfj-vh84-732p)	Tenable Cloud Security	SCA Checks	Local	high
409733	SCA: security update for org.apache.activemq:activemq-client (GHSA-3wfj-vh84-732p)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
130268	Oracle Business Intelligence Publisher Multiple Vulnerabilities (April 2016 CPU)	Nessus	Misc.	Combined	medium
90713	NetIQ Sentinel < 7.4.1 Multiple Vulnerabilities	Nessus	Misc.	Remote	medium
8961	Apache ActiveMQ 5.x < 5.10.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers		critical
85353	Debian DSA-3330-1 : activemq - security update	Nessus	Debian Local Security Checks	Local	high
81374	Apache ActiveMQ 5.x < 5.10.1 / 5.11.0 Multiple Vulnerabilities	Nessus	CGI abuses	Combined	high

Detections

Analytics

CVE-2014-3576

high

Tenable Plugins

high

high

medium

medium

critical

high

high