CVE-2014-3612 Improper Authentication in Apache WSS4J
HighCVSS 7.5
EPSS 6.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.activemq/activemq-broker(Maven) | >= 5.0.0, < 5.10.1 | 5.10.1 |
| org.apache.activemq/activemq-jaas(Maven) | >= 5.0.0, < 5.10.1 | 5.10.1 |
| org.apache.activemq/activemq-broker(Maven) | = 5.10.0 | No fix listed |
| org.apache.activemq/activemq-broker(Maven) | = 5.8.0 | No fix listed |
| org.apache.activemq/activemq-broker(Maven) | = 5.9.0 | No fix listed |
| org.apache.activemq/activemq-broker(Maven) | = 5.9.1 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.0.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.1.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.10.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.2.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.3.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.3.1 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.3.2 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.4.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.4.1 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.4.2 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.4.3 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.5.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.5.1 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.6.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.7.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.8.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.9.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.9.1 | No fix listed |
| debian/activemq(Debian:12) | < 5.6.0+dfsg1-4 | 5.6.0+dfsg1-4 |
Show 19 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/activemq(Debian:13) | < 5.6.0+dfsg1-4 | 5.6.0+dfsg1-4 |
| apache activemq | = 5.0.0 | No fix listed |
| apache activemq | = 5.1.0 | No fix listed |
| apache activemq | = 5.2.0 | No fix listed |
| apache activemq | = 5.3.0 | No fix listed |
| apache activemq | = 5.3.1 | No fix listed |
| apache activemq | = 5.3.2 | No fix listed |
| apache activemq | = 5.4.0 | No fix listed |
| apache activemq | = 5.4.1 | No fix listed |
| apache activemq | = 5.4.2 | No fix listed |
| apache activemq | = 5.4.3 | No fix listed |
| apache activemq | = 5.5.0 | No fix listed |
| apache activemq | = 5.5.1 | No fix listed |
| apache activemq | = 5.6.0 | No fix listed |
| apache activemq | = 5.7.0 | No fix listed |
| apache activemq | = 5.8.0 | No fix listed |
| apache activemq | = 5.9.0 | No fix listed |
| apache activemq | = 5.9.1 | No fix listed |
| apache activemq | = 5.10.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- lists.apache.org
- activemq.apache.org vendor-advisory
- RHSA-2015:0137 vendor-advisory
- RHSA-2015:0138 vendor-advisory
- [oss-security] 20150205 [ANNOUNCE] CVE-2014-3600, CVE-2014-3612 and CVE-2014-8110 - Apache ActiveMQ vulnerabilities mailing-list
- [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/ mailing-list
- 72513 vdb-entry
- github.com patch
- issues.apache.org
- github.com
- github.com
- Debian Security Tracker CVE-2014-3612 vendor-advisory
- bugs.debian.org issue-tracking