It was found that Apache ActiveMQ broker exposed a remote shutdown
command that was possible to call without authentication, permitting
Denial of Service attacks.

Description:
It is possible to shutdown an ActiveMQ broker's listener remotely without
authentication. The offending network packet is sent to the same port as
a message consumer or producer would connect to. If the port is exposed,
the attack will be possible.

The attack is carried out via an undocumented "shutdown control
command". As a response to this command, the ActiveMQ broker will call
"System.exit(0)". Therefore, the broker will stop listening on its
network port, making future remote connections fail.

It was observed that the broker does not actually shut down fully (i.e.,
the Java process continues to run but no further remote connections are
processed). This may indicate that Java shutdown hooks are running
indefinitely. This should be assessed from a functional and security
impact point of view. E.g.:
  * Any automated restart scripts may think the broker is still alive
  * Transactions may be left in an undetermined state
  * Resources may not be released properly