Menu Search

CVE-2015-0233

Severity

Moderate

Affected components

Qpid C++ broker

Affected versions

0.30 and earlier

Fixed versions

0.32 and later

Description

Anonymous access to qpidd cannot be prevented.

An attacker can gain access to qpidd as an anonymous user, even if the ANONYMOUS mechanism is disallowed.

Resolution

A patch is available (QPID-6325) that addresses this vulnerability. The fix will be included in subsequent releases, but can be applied to 0.30 if desired.

Mitigation

Authorization can be used to restrict access to broker entities such as queue and exchanges.

Credit

This issue was discovered by G. Geshev from MWR Labs.

References

QPID-6325