Ubuntu update for activemq

Published: 2024-07-23

Risk	Critical
Patch available	YES
Number of vulnerabilities	6
CVE-ID	CVE-2015-7559 CVE-2018-11775 CVE-2020-13920 CVE-2021-26117 CVE-2022-41678 CVE-2023-46604
CWE-ID	CWE-776 CWE-297 CWE-287 CWE-502
Exploitation vector	Network
Public exploit	Vulnerability #6 is being exploited in the wild.
Vulnerable software Subscribe	Ubuntu Operating systems & Components / Operating system libactivemq-java (Ubuntu package) Operating systems & Components / Operating system package or component activemq (Ubuntu package) Operating systems & Components / Operating system package or component
Vendor	Canonical Ltd.

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) XML Entity Expansion

EUVDB-ID: #VU19262

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-7559

CWE-ID: CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause a denial o service (DoS) attack on the tared system.

The vulnerability exists due to the client package exposed a remote shutdown command in the "ActiveMQConnection" class. A remote attacker can use this flaw to cause a DoS condition on the affected system.

Mitigation

Update the affected package activemq to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 22.04

libactivemq-java (Ubuntu package): before Ubuntu Pro

activemq (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6910-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper validation of certificate with host mismatch

EUVDB-ID: #VU14741

Risk: Low

CVSSv3.1: 4.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-11775

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a MitM attack.

The vulnerability exists due to the Apache ActiveMQ Client does not validate hostname when using SSL/TLS protocol to connect to the Apache ActiveMQ server. A remote attacker can perform a Man-in-the-Middle (MitM) attack and intercept all traffic between Java client and ActiveMQ server.

Mitigation

Update the affected package activemq to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 22.04

libactivemq-java (Ubuntu package): before Ubuntu Pro

activemq (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6910-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper Authentication

EUVDB-ID: #VU46670

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-13920

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects.

Mitigation

Update the affected package activemq to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 22.04

libactivemq-java (Ubuntu package): before Ubuntu Pro

activemq (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6910-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper Authentication

EUVDB-ID: #VU50072

Risk: High

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-26117

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to a logic error in ActiveMQ LDAP login module when configured to to use anonymous access to the LDAP server. A remote attacker can provide a valid username and no password and gain unauthorized access to the system.

Mitigation

Update the affected package activemq to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 22.04

libactivemq-java (Ubuntu package): before Ubuntu Pro

activemq (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6910-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Deserialization of untrusted data

EUVDB-ID: #VU83534

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-41678

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in Jolokia. A remote user can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package activemq to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 22.04

libactivemq-java (Ubuntu package): before Ubuntu Pro

activemq (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6910-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Deserialization of Untrusted Data

EUVDB-ID: #VU82690

Risk: Critical

CVSSv3.1: 9.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2023-46604

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in the OpenWire protocol. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package activemq to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 22.04

libactivemq-java (Ubuntu package): before Ubuntu Pro

activemq (Ubuntu package): before Ubuntu Pro

External links

http://ubuntu.com/security/notices/USN-6910-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.