Bug 955908 (CVE-2013-3060) - CVE-2013-3060 activemq: Unauthenticated access to web console
Summary: CVE-2013-3060 activemq: Unauthenticated access to web console
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2013-3060
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 956950 956951
Blocks: 955433 958349
TreeView+ depends on / blocked
 
Reported: 2013-04-24 04:23 UTC by Arun Babu Neelicattu
Modified: 2023-09-25 12:32 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-09-09 20:46:52 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:1029 0 normal SHIPPED_LIVE Important: Fuse MQ Enterprise 7.1.0 update 2013-07-09 21:56:11 UTC
Red Hat Product Errata RHSA-2013:1221 0 normal SHIPPED_LIVE Important: Fuse Message Broker 5.5.1 security update 2013-09-09 20:55:25 UTC

Description Arun Babu Neelicattu 2013-04-24 04:23:25 UTC 
The web console in Apache ActiveMQ before 5.8.0 does not require authentication. Remote attackers could use this flaw to modify the state of the ActiveMQ environment, obtain sensitive information or cause a denial of service via HTTP requests.
Comment 1 David Jorm 2013-04-26 05:11:07 UTC 
External References:

(none)
Comment 3 David Jorm 2013-04-26 05:26:15 UTC 
Statement:

Fuse ESB Enterprise 7.1.0, Fuse MQ Enterprise 7.1.1, JBoss Fuse 6.0.0 and JBoss A-MQ 6.0.0 all contain the Apache ActiveMQ web console, but it is not deployed by default. The documentation for deploying the web console covers the configuration needed to ensure authentication is enabled, therefore these products are not affected by this flaw. In a future update to these products, the web console will be configured so that authentication is automatically enabled if the web console is deployed, eliminating the need to manually configure it.

A future update may address this flaw in Fuse Message Broker 5.5.1.
Comment 6 errata-xmlrpc 2013-07-09 17:57:58 UTC 
This issue has been addressed in following products:

  Fuse MQ Enterprise 7.1.0

Via RHSA-2013:1029 https://rhn.redhat.com/errata/RHSA-2013-1029.html
Comment 7 errata-xmlrpc 2013-09-09 16:57:06 UTC 
This issue has been addressed in following products:

  Fuse Message Broker 5.5.1

Via RHSA-2013:1221 https://rhn.redhat.com/errata/RHSA-2013-1221.html
Note You need to log in before you can comment on or make changes to this bug.