CVE-2014-3612: Improper Authentication in Apache WSS4J
Summary
CVE-2014-3612: Improper Authentication in Apache WSS4J. Affects org.apache.activemq:activemq-broker versions >= 5.0.0, < 5.10.1. Fixed in 5.10.1. How to fix ↓
Also tracked for
- activemq · Debian:11
The same CVE-2014-3612 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache WSS4J is a Java library for implementing the OASIS Web Services Security (WS-Security) standards. It provides functions for securing SOAP messages by adding digital signatures, encryption, and other security features. The library is widely used in various Java applications, including Apache ActiveMQ, a popular message broker. This vulnerability affects the LDAPLoginModule implementation in Apache ActiveMQ 5.x before version 5.10.1.
Vulnerability Detail
The vulnerability allows remote attackers to bypass authentication in Apache ActiveMQ by logging in with an empty password and a valid username. This triggers an unauthenticated bind, effectively bypassing the authentication process. Attackers can exploit this vulnerability to gain unauthorized access to the system and perform malicious actions. It is important to note that this vulnerability is different from CVE-2015-6524, which involves the use of wildcard operators in usernames.
How To Fix
Minimum fixed version
5.10.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by upgrading to Apache ActiveMQ 5.10.1 or a later version.
Conclusion
The vulnerability in Apache WSS4J's LDAPLoginModule implementation can lead to unauthorized access to Apache ActiveMQ. To mitigate this risk, it is recommended to upgrade to Apache ActiveMQ 5.10.1 or a later version. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.activemq:activemq-broker →
FAQ
Apache ActiveMQ is an open-source message broker that provides reliable messaging between distributed applications. It supports multiple messaging protocols and can be used in various enterprise environments.
The LDAPLoginModule is a component of the Java Authentication and Authorization Service (JAAS) that allows authentication against an LDAP server. It is used in Apache ActiveMQ for user authentication.
The vulnerability occurs when an attacker logs in with an empty password and a valid username. This triggers an unauthenticated bind, bypassing the authentication process and granting unauthorized access to the system.
The vulnerability allows attackers to gain unauthorized access to Apache ActiveMQ and potentially perform malicious actions. This can include reading, modifying, or deleting messages, disrupting message queues, or compromising the confidentiality and integrity of the system.
There is no known public exploit for this vulnerability at the time of this report. However, it is crucial to apply the official fix to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:activemq-broker.
