Bug 1135912 (CVE-2014-3612)

Summary:	CVE-2014-3612 ActiveMQ JAAS: LDAPLoginModule allows empty password authentication
Product:	[Other] Security Response	Reporter:	Arun Babu Neelicattu <aneelica>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	bleanhar, ccoleman, chazlett, dbosanac, dmcphers, grocha, jdetiber, jialiu, jkeck, jokerman, kseifried, lmeyer, mmccomas, mmcgrath, security-response-team, weli
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was found that if a configured LDAP server supported the unauthenticated authentication mechanism (as described by RFC 4513), the LDAPLoginModule implementation, provided by ActiveMQ Java Authentication and Authorization Service (JAAS), would consider an authentication attempt to be successful for a valid user that provided an empty password. A remote attacker could use this flaw to bypass the authentication mechanism of an application using LDAPLoginModule, and assume a role of any valid user within that application.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-07-12 23:04:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1165359
Bug Blocks:	1135914, 1183155

Description Arun Babu Neelicattu 2014-09-01 07:34:36 UTC

IssueDescription:

It was found that if a configured LDAP server supported the unauthenticated authentication mechanism (as described by RFC 4513), the LDAPLoginModule implementation, provided by ActiveMQ Java Authentication and Authorization Service (JAAS), would consider an authentication attempt to be successful for a valid user that provided an empty password. A remote attacker could use this flaw to bypass the authentication mechanism of an application using LDAPLoginModule, and assume a role of any valid user within that application.

Comment 3 Arun Babu Neelicattu 2015-02-05 01:23:35 UTC

Acknowledgements:

Red Hat would like to thank Georgi Geshev of MWR Labs for reporting this issue.

Comment 4 errata-xmlrpc 2015-02-05 21:05:46 UTC

This issue has been addressed in the following products:

  Fuse ESB Enterprise 7.1.0
  Fuse MQ Enterprise 7.1.0

Via RHSA-2015:0138 https://rhn.redhat.com/errata/RHSA-2015-0138.html

Comment 5 errata-xmlrpc 2015-02-05 21:31:24 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Fuse 6.1.0
  Red Hat JBoss A-MQ 6.1.0

Via RHSA-2015:0137 https://rhn.redhat.com/errata/RHSA-2015-0137.html

Comment 7 Chess Hazlett 2016-07-12 23:04:27 UTC

Closing flaw bug, leaving tracker for Kurt.