Bug 1198306 (CVE-2014-3576) - CVE-2014-3576 ActiveMQ: DoS via unauthenticated remote shutdown command
Summary: CVE-2014-3576 ActiveMQ: DoS via unauthenticated remote shutdown command
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2014-3576
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1130476
TreeView+ depends on / blocked
 
Reported: 2015-03-03 18:48 UTC by Chess Hazlett
Modified: 2019-09-29 13:29 UTC (History)
6 users (show)

Fixed In Version: ActiveMQ 5.10.1, ActiveMQ 5.11.0
Doc Type: Bug Fix
Doc Text:
It was found that the Apache ActiveMQ broker exposed a remote shutdown command without requiring any authentication to use it. A remote, unauthenticated attacker could use this flaw to shut down ActiveMQ broker's listener.
Clone Of:
Environment:
Last Closed: 2015-07-01 00:06:07 UTC


Attachments (Terms of Use)

Description Chess Hazlett 2015-03-03 18:48:51 UTC
It was found that Apache ActiveMQ broker exposed a remote shutdown
command that was possible to call without authentication, permitting
Denial of Service attacks.

Description:
It is possible to shutdown an ActiveMQ broker's listener remotely without
authentication. The offending network packet is sent to the same port as
a message consumer or producer would connect to. If the port is exposed,
the attack will be possible.

The attack is carried out via an undocumented "shutdown control
command". As a response to this command, the ActiveMQ broker will call
"System.exit(0)". Therefore, the broker will stop listening on its
network port, making future remote connections fail.

It was observed that the broker does not actually shut down fully (i.e.,
the Java process continues to run but no further remote connections are
processed). This may indicate that Java shutdown hooks are running
indefinitely. This should be assessed from a functional and security
impact point of view. E.g.:
  * Any automated restart scripts may think the broker is still alive
  * Transactions may be left in an undetermined state
  * Resources may not be released properly


Note You need to log in before you can comment on or make changes to this bug.