CVE-2014-3612

NameCVE-2014-3612
DescriptionThe LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh (attack range: remote)
Debian Bugs777196

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
activemq (PTS)wheezy5.6.0+dfsg-1+deb7u2fixed
wheezy (security)5.6.0+dfsg-1+deb7u3fixed
jessie5.6.0+dfsg1-4+deb8u3fixed
jessie (security)5.6.0+dfsg1-4+deb8u2fixed
stretch5.14.3-3fixed
buster, sid5.14.5-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
activemqsource(unstable)5.6.0+dfsg1-4low777196
activemqsourcewheezy5.6.0+dfsg-1+deb7u1high

Notes

http://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txt

Search for package or bug name: Reporting problems