Versions 5.x of Apache ActiveMQ prior to 5.10.1 are affected by the following vulnerabilities :

 - An unauthenticated, remote attacker can crash the broker listener by sending a packet to the same port that a message consumer or product connects to, resulting in a denial of service condition. (CVE-2014-3576)
 - An XXE (Xml eXternal Entity) injection flaw related to XPath selectors exists that is triggered during the parsing of XML data. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can disclose the contents of arbitrary files. (CVE-2014-3600)
 - Two flaws exists that allow a reflected cross-site scripting (XSS) attack. The first flaw exists because the 'connection.jsp' script does not validate input to the 'connectionID' parameter before returning it to users. The second flaw exists because the 'browse.jsp' script does not validate input to the 'JMSDestination' GET parameter before returning it to users. Either of these vulnerabiltiies may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.  (CVE-2014-8110)
 - A flaw exists that allows a stored cross-site scripting (XSS) attack. This flaw exists because the 'createDestination.action' script does not validate input to the 'JMSDestination' parameter before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2010-0684)
 - A flaw exists in LDAPLoginModule in Java Authentication and Authorization Service (JAAS) that is triggered when handling an authentication attempt that contains an invalid password. This authentication attempt will be considered successful, which can allow a remote attacker to bypass authentication mechanisms. This flaw is also triggered during the handling of an authentication attempt that contains a wildcard operator in place of a username. This may allow a remote attacker to bypass authentication mechanisms (CVE-2014-3612) and can allow remote attackers to obtain credentials via a brute force attack. (CVE-2015-6524)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache
    ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain
    credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to
    different vulnerability types. (CVE-2015-6524)

CVE-2015-6524 的修正 (rhbz#1257246、1257248)

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

- 针对 CVE-2015-6524 的补丁 (rhbz#1257246,1257248)

请注意，Tenable Network Security 已直接从 Fedora 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

CVE-2015-6524 の修正（rhbz#1257246、1257248）

注意：Tenable Network Security は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。Tenable では、できる限り新たな問題を持ち込まないように、自動的に整理して書式設定するようにしています。

fix for CVE-2015-6524 (rhbz#1257246,1257248)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
8961	Apache ActiveMQ 5.x < 5.10.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	10/22/2015	3/6/2019	critical
408628	SCA: security update for org.apache.activemq:activemq-broker, org.apache.activemq:activemq-jaas (GHSA-23cr-5hr4-rgwv)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	medium
408628	SCA: security update for org.apache.activemq:activemq-broker, org.apache.activemq:activemq-jaas (GHSA-23cr-5hr4-rgwv)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	medium
86265	Fedora 23：activemq-5.6.0-12.fc23 (2015-5622085024)	Nessus	Fedora Local Security Checks	10/5/2015	1/11/2021	medium
89280	Fedora 22：activemq-5.6.0-12.fc22 (2015-701a1e1a5f)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	medium
86265	Fedora 23：activemq-5.6.0-12.fc23 (2015-5622085024)	Nessus	Fedora Local Security Checks	10/5/2015	1/11/2021	medium
89280	Fedora 22：activemq-5.6.0-12.fc22 (2015-701a1e1a5f)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	medium
86265	Fedora 23：activemq-5.6.0-12.fc23（2015-5622085024）	Nessus	Fedora Local Security Checks	10/5/2015	1/11/2021	medium
89280	Fedora 22：activemq-5.6.0-12.fc22（2015-701a1e1a5f）	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	medium
86265	Fedora 23 : activemq-5.6.0-12.fc23 (2015-5622085024)	Nessus	Fedora Local Security Checks	10/5/2015	1/11/2021	medium
89280	Fedora 22 : activemq-5.6.0-12.fc22 (2015-701a1e1a5f)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	medium

Detections

Analytics

Plugins Search

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium