CVE-2015-6524 Improper Input Validation in Apache ActiveMQ
MediumCVSS 5.0
EPSS 8.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.activemq/activemq-broker(Maven) | >= 5.0.0, <= 5.10.1 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | >= 5.0.0, <= 5.10.1 | No fix listed |
| org.apache.activemq/activemq-broker(Maven) | >= 5.0.0, < 5.10.2 | 5.10.2 |
| org.apache.activemq/activemq-broker(Maven) | = 5.10.0 | No fix listed |
| org.apache.activemq/activemq-broker(Maven) | = 5.10.1 | No fix listed |
| org.apache.activemq/activemq-broker(Maven) | = 5.8.0 | No fix listed |
| org.apache.activemq/activemq-broker(Maven) | = 5.9.0 | No fix listed |
| org.apache.activemq/activemq-broker(Maven) | = 5.9.1 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | >= 5.0.0, < 5.10.2 | 5.10.2 |
| org.apache.activemq/activemq-jaas(Maven) | = 5.0.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.1.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.10.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.10.1 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.2.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.3.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.3.1 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.3.2 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.4.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.4.1 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.4.2 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.4.3 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.5.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.5.1 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.6.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.7.0 | No fix listed |
Show 25 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.activemq/activemq-jaas(Maven) | = 5.8.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.9.0 | No fix listed |
| org.apache.activemq/activemq-jaas(Maven) | = 5.9.1 | No fix listed |
| debian/activemq(Debian:12) | < 5.6.0+dfsg1-4 | 5.6.0+dfsg1-4 |
| debian/activemq(Debian:13) | < 5.6.0+dfsg1-4 | 5.6.0+dfsg1-4 |
| fedoraproject fedora | = 22 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
| apache activemq | = 5.0.0 | No fix listed |
| apache activemq | = 5.1.0 | No fix listed |
| apache activemq | = 5.2.0 | No fix listed |
| apache activemq | = 5.3.0 | No fix listed |
| apache activemq | = 5.3.1 | No fix listed |
| apache activemq | = 5.3.2 | No fix listed |
| apache activemq | = 5.4.0 | No fix listed |
| apache activemq | = 5.4.1 | No fix listed |
| apache activemq | = 5.4.2 | No fix listed |
| apache activemq | = 5.4.3 | No fix listed |
| apache activemq | = 5.5.0 | No fix listed |
| apache activemq | = 5.5.1 | No fix listed |
| apache activemq | = 5.6.0 | No fix listed |
| apache activemq | = 5.7.0 | No fix listed |
| apache activemq | = 5.8.0 | No fix listed |
| apache activemq | = 5.9.0 | No fix listed |
| apache activemq | = 5.9.1 | No fix listed |
| apache activemq | = 5.10.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- activemq.apache.org vendor-advisory
- FEDORA-2015-5622085024 third-party-advisory vendor-advisory
- FEDORA-2015-701a1e1a5f third-party-advisory vendor-advisory
- github.com patch
- github.com
- github.com
- Debian Security Tracker CVE-2015-6524 vendor-advisory