#VU19262 XML Entity Expansion in ActiveMQ - CVE-2015-7559


| Updated: 2019-07-22

Vulnerability identifier: #VU19262

Vulnerability risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2015-7559

CWE-ID: CWE-776

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
ActiveMQ
Server applications / Mail servers

Vendor: Apache Foundation

Description

The vulnerability allows a remote attacker to cause a denial o service (DoS) attack on the tared system.

The vulnerability exists due to the client package exposed a remote shutdown command in the "ActiveMQConnection" class. A remote attacker can use this flaw to cause a DoS condition on the affected system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

ActiveMQ: 5.0.0, 5.1.0 - 5.14.4, 5.2 - 5.2.0, 5.3.0 - 5.3.2, 5.4.0 - 5.4.3, 5.5.0 - 5.5.1, 5.6.0, 5.7.0, 5.8.0, 5.9.0 - 5.9.1

External links
https://issues.apache.org/jira/browse/AMQ-6470

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Ubuntu update for activemq
Denial of service in Apache ActiveMQ Client