CVE-2015-0233
Severity§
Moderate
Affected components§
Qpid C++ broker
Affected versions§
0.30 and earlier
Fixed versions§
0.32 and later
Description§
Anonymous access to qpidd cannot be prevented.
An attacker can gain access to qpidd as an anonymous user, even if the ANONYMOUS mechanism is disallowed.
Resolution§
A patch is available (QPID-6325) that addresses this vulnerability. The fix will be included in subsequent releases, but can be applied to 0.30 if desired.
Mitigation§
Authorization can be used to restrict access to broker entities such as queue and exchanges.
Credit§
This issue was discovered by G. Geshev from MWR Labs.
References§
Apache Qpid, Messaging built on AMQP; Copyright © 2015 The Apache Software Foundation; Licensed under the Apache License, Version 2.0; Apache Qpid, Qpid, Qpid Proton, Proton, Apache, the Apache feather logo, and the Apache Qpid project logo are trademarks of The Apache Software Foundation; All other marks mentioned may be trademarks or registered trademarks of their respective owners