Bug 1135912 – CVE-2014-3612 ActiveMQ JAAS: LDAPLoginModule allows empty password authentication

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1135912 - (CVE-2014-3612) CVE-2014-3612 ActiveMQ JAAS: LDAPLoginModule allows empty password authentication

Summary:	CVE-2014-3612 ActiveMQ JAAS: LDAPLoginModule allows empty password authentica...

Status:	CLOSED ERRATA

Aliases:	CVE-2014-3612

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	high Severity high
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=important,public=20150205,repo...
Keywords:	Security

Depends On:	1165359
Blocks:	1135914 1183155
	Show dependency tree / graph

Reported:	2014-09-01 03:34 EDT by Arun Babu Neelicattu
Modified:	2016-07-12 19:04 EDT (History)
CC List:	16 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	It was found that if a configured LDAP server supported the unauthenticated authentication mechanism (as described by RFC 4513), the LDAPLoginModule implementation, provided by ActiveMQ Java Authentication and Authorization Service (JAAS), would consider an authentication attempt to be successful for a valid user that provided an empty password. A remote attacker could use this flaw to bypass the authentication mechanism of an application using LDAPLoginModule, and assume a role of any valid user within that application.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2016-07-12 19:04:27 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2015:0137	normal	SHIPPED_LIVE	Important: Red Hat JBoss Fuse/A-MQ 6.1.0 security and bug fix update	2015-02-05 21:30:51 EST
Red Hat Product Errata	RHSA-2015:0138	normal	SHIPPED_LIVE	Important: Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 security update	2015-02-05 21:05:31 EST

Groups: None (edit)

Description Arun Babu Neelicattu 2014-09-01 03:34:36 EDT

IssueDescription:

It was found that if a configured LDAP server supported the unauthenticated authentication mechanism (as described by RFC 4513), the LDAPLoginModule implementation, provided by ActiveMQ Java Authentication and Authorization Service (JAAS), would consider an authentication attempt to be successful for a valid user that provided an empty password. A remote attacker could use this flaw to bypass the authentication mechanism of an application using LDAPLoginModule, and assume a role of any valid user within that application.

Comment 3 Arun Babu Neelicattu 2015-02-04 20:23:35 EST

Acknowledgements:

Red Hat would like to thank Georgi Geshev of MWR Labs for reporting this issue.

Comment 4 errata-xmlrpc 2015-02-05 16:05:46 EST

This issue has been addressed in the following products:

  Fuse ESB Enterprise 7.1.0
  Fuse MQ Enterprise 7.1.0

Via RHSA-2015:0138 https://rhn.redhat.com/errata/RHSA-2015-0138.html

Comment 5 errata-xmlrpc 2015-02-05 16:31:24 EST

This issue has been addressed in the following products:

  Red Hat JBoss Fuse 6.1.0
  Red Hat JBoss A-MQ 6.1.0

Via RHSA-2015:0137 https://rhn.redhat.com/errata/RHSA-2015-0137.html

Comment 7 Chess Hazlett 2016-07-12 19:04:27 EDT

Closing flaw bug, leaving tracker for Kurt.

Note You need to log in before you can comment on or make changes to this bug.