A flaw in Apache ActiveMQ before 5.6.0 could allow a remote unauthenticated attacker to abuse the 'failover' feature, allowing them to trigger a denial of service against the broker service. An attacker can issue multiple ActiveMQ openwire connection requests using the string 'failover:tcp://[IP]:61616', and due to the 'failure' mechanism, all TCP connections remain active even if a valid session is not created. After a few thousand requests, a 'java.net.SocketException: Too many open files' exception is triggered, leading to a freeze or crash of the broker (and possibly connected systems as well). References: https://issues.apache.org/jira/browse/AMQ-3294 http://secunia.com/advisories/47112 http://svn.apache.org/viewvc?view=revision&revision=1209700 http://svn.apache.org/viewvc?view=revision&revision=1211844
Statement: Not vulnerable. Apache ActiveMQ is not shipped with any supported Red Hat products.