Apache ActiveMQ - Remote Shutdown Command Exposure
Summary
DLA-913-1: activemq - security update. Affects activemq versions < 5.6.0+dfsg-1+deb7u3. Fixed in 5.6.0+dfsg-1+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker written in Java that provides support for messaging protocols such as AMQP, MQTT, and STOMP. It is widely used for building distributed systems and implementing messaging patterns. However, a vulnerability has been discovered in the ActiveMQConnection class, which allows an attacker to expose a remote shutdown command. This flaw can be exploited to achieve denial of service on a client.
Vulnerability Detail
The vulnerability in Apache ActiveMQ arises from the exposure of a remote shutdown command in the ActiveMQConnection class. By leveraging this flaw, an attacker can send a specially crafted request to a client, causing it to shut down unexpectedly. This can lead to a denial of service situation, disrupting the normal operation of the affected client. The vulnerability affects versions prior to 5.6.0+dfsg-1+deb7u3 of the activemq package in Debian 7 Wheezy.
How To Fix
Minimum fixed version
5.6.0+dfsg-1+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade activemqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Apache ActiveMQ that exposes a remote shutdown command can be mitigated by upgrading the activemq package to version 5.6.0+dfsg-1+deb7u3 or later. It is important to promptly apply this fix to prevent potential denial of service attacks. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for activemq →
FAQ
Apache ActiveMQ is an open-source message broker written in Java that provides support for messaging protocols such as AMQP, MQTT, and STOMP. It is widely used for building distributed systems and implementing messaging patterns.
The vulnerability allows an attacker to expose a remote shutdown command in the ActiveMQConnection class. By exploiting this flaw, the attacker can cause a denial of service on a client, disrupting its normal operation.
Versions prior to 5.6.0+dfsg-1+deb7u3 of the activemq package in Debian 7 Wheezy are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade the activemq package to version 5.6.0+dfsg-1+deb7u3 or later. Detailed instructions can be found in the Debian LTS security advisories documentation.
More information about Debian LTS security advisories, including how to apply updates and frequently asked questions, can be found at the Debian LTS wiki.
Related vulnerabilities
Recent vulnerabilities recorded for activemq.
