[CVE-2020-11998] Apache ActiveMQ JMX remote client could execute arbitrary code

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
[CVE-2020-11998] Apache ActiveMQ JMX remote client could execute arbitrary code

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Jean-Baptiste Onofre &lt;jb () nanthrax net&gt;

Date: Thu, 10 Sep 2020 11:45:14 +0200

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
CVE-2020-11998: Apache ActiveMQ JMX remote client could execute arbitrary code

Severity: Moderate

Vendor: The Apache Software Foundation

Affected Version: only Apache ActiveMQ 5.15.12

Vulnerability details: 
A regression has been introduced in the commit preventing JMX re-bind.
By passing an empty environment map to RMIConnectorServer, instead of the map that contains
he authentication credentials, it leaves ActiveMQ open to the following attack:

 https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html

"A remote client could create a javax.management.loading.MLet MBean and use
it to create new MBeans from arbitrary URLs, at least if there is no
security manager. In other words, a rogue remote client could make your
Java application execute arbitrary code."

Mitigation: Upgrade to Apache ActiveMQ 5.15.13

Credit: Jonathan Gallimore &amp; Colm O hEigeartaigh

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

[CVE-2020-11998] Apache ActiveMQ JMX remote client could execute arbitrary code Jean-Baptiste Onofre (Sep 10)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->