CVE

Id
70908  
CVE No.
CVE-2014-3612  
Status
Candidate  
Description
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.  
Phase
Assigned (20140514)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
675452 70908 CVE-2014-3612 MLIST:[oss-security] 20150205 [ANNOUNCE] CVE-2014-3600, CVE-2014-3612 and CVE-2014-8110 - Apache ActiveMQ vulnerabilities  View
675453 70908 CVE-2014-3612 URL:http://seclists.org/oss-sec/2015/q1/427  View
675454 70908 CVE-2014-3612 CONFIRM:http://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txt  View
675455 70908 CVE-2014-3612 REDHAT:RHSA-2015:0137  View
675456 70908 CVE-2014-3612 URL:http://rhn.redhat.com/errata/RHSA-2015-0137.html  View
675457 70908 CVE-2014-3612 REDHAT:RHSA-2015:0138  View
675458 70908 CVE-2014-3612 URL:http://rhn.redhat.com/errata/RHSA-2015-0138.html  View
675459 70908 CVE-2014-3612 BID:72513  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
16639 JVNDB-2014-005514 cURL および libcurl における同一生成元ポリシーを回避される脆弱性 cURL および libcurl には、同一生成元ポリシーを回避され、任意のサイトに Cookie を設定される脆弱性が存在します。 CVE-2014-3620 70908 5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005514.html  View