Bug 1198306 (CVE-2014-3576)

Summary: CVE-2014-3576 ActiveMQ: DoS via unauthenticated remote shutdown command
Product: [Other] Security Response Reporter: Chess Hazlett <chazlett>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: chazlett, fweimer, jshepherd, security-response-team, vkaigoro, weli
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: ActiveMQ 5.10.1, ActiveMQ 5.11.0 Doc Type: Bug Fix
Doc Text:
It was found that the Apache ActiveMQ broker exposed a remote shutdown command without requiring any authentication to use it. A remote, unauthenticated attacker could use this flaw to shut down ActiveMQ broker's listener.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2015-07-01 00:06:07 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1130476    

Description Chess Hazlett 2015-03-03 18:48:51 UTC 
It was found that Apache ActiveMQ broker exposed a remote shutdown
command that was possible to call without authentication, permitting
Denial of Service attacks.

Description:
It is possible to shutdown an ActiveMQ broker's listener remotely without
authentication. The offending network packet is sent to the same port as
a message consumer or producer would connect to. If the port is exposed,
the attack will be possible.

The attack is carried out via an undocumented "shutdown control
command". As a response to this command, the ActiveMQ broker will call
"System.exit(0)". Therefore, the broker will stop listening on its
network port, making future remote connections fail.

It was observed that the broker does not actually shut down fully (i.e.,
the Java process continues to run but no further remote connections are
processed). This may indicate that Java shutdown hooks are running
indefinitely. This should be assessed from a functional and security
impact point of view. E.g.:
  * Any automated restart scripts may think the broker is still alive
  * Transactions may be left in an undetermined state
  * Resources may not be released properly