CVE-2014-3600

Related Files

Red Hat Security Advisory 2015-0138-01

Posted Feb 5, 2015

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2015-0138-01 - Fuse ESB Enterprise is an integration platform based on Apache ServiceMix. Fuse MQ Enterprise, based on Apache ActiveMQ, is a standards-compliant messaging system that is tailored for use in mission critical applications. This release of Fuse ESB Enterprise/MQ Enterprise 7.1.0 Patch 8 on Rollup Patch 1 is an update to Fuse ESB Enterprise 7.1.0 and Fuse MQ Enterprise 7.1.0. The following security issues are addressed with this release: It was found that if a configured LDAP server supported the unauthenticated authentication mechanism, the LDAPLoginModule implementation, provided by ActiveMQ Java Authentication and Authorization Service, would consider an authentication attempt to be successful for a valid user that provided an empty password. A remote attacker could use this flaw to bypass the authentication mechanism of an application using LDAPLoginModule, and assume a role of any valid user within that application.

tags | advisory, java, remote

systems | linux, redhat

advisories | CVE-2014-3600, CVE-2014-3612

SHA-256 | 3fb504c89a77ba29c6ddb80624051c39c3aac4e94b38f8e62fba9c204b4321f2

Download | Favorite | View

Red Hat Security Advisory 2015-0137-01

Posted Feb 5, 2015

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2015-0137-01 - Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications. This patch is an update to Red Hat JBoss Fuse 6.1.0 and Red Hat JBoss A-MQ 6.1.0. It includes a bug fix, which is documented in the readme.txt file included with the patch files. The following security issues are addressed in this release: It was found that if a configured LDAP server supported the unauthenticated authentication mechanism, the LDAPLoginModule implementation, provided by ActiveMQ Java Authentication and Authorization Service, would consider an authentication attempt to be successful for a valid user that provided an empty password. A remote attacker could use this flaw to bypass the authentication mechanism of an application using LDAPLoginModule, and assume a role of any valid user within that application.

tags | advisory, java, remote

systems | linux, redhat

advisories | CVE-2014-3600, CVE-2014-3612

SHA-256 | 51aea3670f3486cf44a8f419db3f8ab78d14b31b2dea53468ba1c2dc2a273d7e

Download | Favorite | View