{"id": "RHSA-2012:0528", "hash": "7d906f568f3e0b13d14ca46cb17b9c01", "type": "redhat", "bulletinFamily": "unix", "title": "(RHSA-2012:0528) Moderate: Red Hat Enterprise MRG Messaging 2.1 security and enhancement update", "description": "Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a next-generation\nIT infrastructure for enterprise computing. MRG offers increased\nperformance, reliability, interoperability, and faster computing for\nenterprise customers.\n\nMRG Messaging is a high-speed reliable messaging distribution for Linux\nbased on AMQP (Advanced Message Queuing Protocol), an open protocol\nstandard for enterprise messaging that is designed to make mission critical\nmessaging widely available as a standard service, and to make enterprise\nmessaging interoperable across platforms, programming languages, and\nvendors. MRG Messaging includes an AMQP 0-10 messaging broker; AMQP 0-10\nclient libraries for C++, Java JMS, and Python; as well as persistence\nlibraries and management tools.\n\nIt was found that Qpid accepted any password or SASL mechanism, provided\nthe remote user knew a valid cluster username. This could give a remote\nattacker unauthorized access to the cluster, exposing cluster messages and\ninternal Qpid/MRG configurations. (CVE-2011-3620)\n\nNote: If you are using an ACL, the cluster-username must be allowed to\npublish to the qpid.cluster-credentials exchange. For example, if your\ncluster-username is \"foo\", in your ACL file:\n\nacl allow foo@QPID publish exchange name=qpid.cluster-credentials\n\nThe CVE-2011-3620 fix changes the cluster initialization protocol. As such,\nthe cluster with all new version brokers must be restarted for the changes\nto take effect. Refer below for details.\n\nThese updated packages provide numerous enhancements and bug fixes for the\nMessaging component of MRG. Space precludes documenting all of these\nchanges in this advisory. Documentation for these changes will be available\nshortly in the Technical Notes document linked to in the References\nsection.\n\nAll users of the Messaging capabilities of Red Hat Enterprise MRG 2.1 are\nadvised to upgrade to these updated packages, which resolve the issues and\nadd the enhancements noted in the Red Hat Enterprise MRG 2 Technical Notes.\nAfter installing the updated packages, stop the cluster by either running\n\"service qpidd stop\" on all nodes, or \"qpid-cluster --all-stop\" on any one\nof the cluster nodes. Once stopped, restart the cluster with\n\"service qpidd start\" on all nodes for the update to take effect.\n", "published": "2012-04-30T04:00:00", "modified": "2018-06-07T02:47:19", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://access.redhat.com/errata/RHSA-2012:0528", "reporter": "RedHat", "references": [], "cvelist": ["CVE-2011-3620"], "lastseen": "2018-12-11T19:40:59", "history": [{"bulletin": {"id": "RHSA-2012:0528", "hash": "", "type": "redhat", "bulletinFamily": "unix", "title": "(RHSA-2012:0528) Moderate: Red Hat Enterprise MRG Messaging 2.1 security and enhancement update", "description": "Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a next-generation\nIT infrastructure for enterprise computing. MRG offers increased\nperformance, reliability, interoperability, and faster computing for\nenterprise customers.\n\nMRG Messaging is a high-speed reliable messaging distribution for Linux\nbased on AMQP (Advanced Message Queuing Protocol), an open protocol\nstandard for enterprise messaging that is designed to make mission critical\nmessaging widely available as a standard service, and to make enterprise\nmessaging interoperable across platforms, programming languages, and\nvendors. MRG Messaging includes an AMQP 0-10 messaging broker; AMQP 0-10\nclient libraries for C++, Java JMS, and Python; as well as persistence\nlibraries and management tools.\n\nIt was found that Qpid accepted any password or SASL mechanism, provided\nthe remote user knew a valid cluster username. This could give a remote\nattacker unauthorized access to the cluster, exposing cluster messages and\ninternal Qpid/MRG configurations. (CVE-2011-3620)\n\nNote: If you are using an ACL, the cluster-username must be allowed to\npublish to the qpid.cluster-credentials exchange. For example, if your\ncluster-username is \"foo\", in your ACL file:\n\nacl allow foo@QPID publish exchange name=qpid.cluster-credentials\n\nThe CVE-2011-3620 fix changes the cluster initialization protocol. As such,\nthe cluster with all new version brokers must be restarted for the changes\nto take effect. Refer below for details.\n\nThese updated packages provide numerous enhancements and bug fixes for the\nMessaging component of MRG. Space precludes documenting all of these\nchanges in this advisory. Documentation for these changes will be available\nshortly in the Technical Notes document linked to in the References\nsection.\n\nAll users of the Messaging capabilities of Red Hat Enterprise MRG 2.1 are\nadvised to upgrade to these updated packages, which resolve the issues and\nadd the enhancements noted in the Red Hat Enterprise MRG 2 Technical Notes.\nAfter installing the updated packages, stop the cluster by either running\n\"service qpidd stop\" on all nodes, or \"qpid-cluster --all-stop\" on any one\nof the cluster nodes. Once stopped, restart the cluster with\n\"service qpidd start\" on all nodes for the update to take effect.\n", "published": "2012-04-30T04:00:00", "modified": "2017-03-03T16:12:23", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://access.redhat.com/errata/RHSA-2012:0528", "reporter": "RedHat", "references": [], "cvelist": ["CVE-2011-3620"], "lastseen": "2017-03-03T19:18:28", "history": [], "viewCount": 3, "enchantments": {"score": {"value": 5.0, "vector": "NONE"}}, "objectVersion": "1.4", "affectedPackage": [{"arch": "x86_64", "packageFilename": "condor-classads-7.6.5-0.14.el6.x86_64.rpm", "OSVersion": "6", "packageName": "condor-classads", "OS": "RedHat", "packageVersion": "7.6.5-0.14.el6", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "condor-kbdd-7.6.5-0.14.el6.x86_64.rpm", "OSVersion": "6", "packageName": "condor-kbdd", "OS": "RedHat", "packageVersion": "7.6.5-0.14.el6", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "condor-debuginfo-7.6.5-0.14.el6.x86_64.rpm", "OSVersion": "6", "packageName": "condor-debuginfo", "OS": "RedHat", "packageVersion": "7.6.5-0.14.el6", "operator": "lt"}, {"arch": "src", "packageFilename": "qpid-java-0.14-3.el6.src.rpm", "OSVersion": "6", "packageName": "qpid-java", "OS": "RedHat", "packageVersion": "0.14-3.el6", "operator": "lt"}, {"arch": "i686", "packageFilename": "condor-plumage-7.6.5-0.14.el6.i686.rpm", "OSVersion": "6", "packageName": "condor-plumage", "OS": "RedHat", "packageVersion": "7.6.5-0.14.el6", "operator": "lt"}, {"arch": "src", "packageFilename": "qpid-jca-0.14-9.el6.src.rpm", "OSVersion": "6", "packageName": "qpid-jca", "OS": "RedHat", "packageVersion": "0.14-9.el6", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "condor-vm-gahp-7.6.5-0.14.el6.x86_64.rpm", "OSVersion": "6", "packageName": "condor-vm-gahp", "OS": "RedHat", "packageVersion": "7.6.5-0.14.el6", "operator": "lt"}, {"arch": "src", "packageFilename": "condor-7.6.5-0.14.el6.src.rpm", "OSVersion": "6", "packageName": "condor", "OS": "RedHat", "packageVersion": "7.6.5-0.14.el6", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "qpid-cpp-debuginfo-0.14-14.el6_2.x86_64.rpm", "OSVersion": "6", "packageName": "qpid-cpp-debuginfo", "OS": "RedHat", "packageVersion": "0.14-14.el6_2", "operator": "lt"}, {"arch": "i686", "packageFilename": "qpid-cpp-client-rdma-0.14-14.el6_2.i686.rpm", "OSVersion": "6", "packageName": "qpid-cpp-client-rdma", "OS": "RedHat", "packageVersion": "0.14-14.el6_2", "operator": "lt"}, {"arch": "noarch", "packageFilename": "qpid-java-common-0.14-3.el6.noarch.rpm", "OSVersion": "6", "packageName": "qpid-java-common", "OS": "RedHat", "packageVersion": "0.14-3.el6", "operator": "lt"}, {"arch": "i686", "packageFilename": "qpid-cpp-server-xml-0.14-14.el6_2.i686.rpm", "OSVersion": "6", "packageName": "qpid-cpp-server-xml", "OS": "RedHat", "packageVersion": "0.14-14.el6_2", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "qpid-cpp-client-rdma-0.14-14.el6_2.x86_64.rpm", "OSVersion": "6", "packageName": "qpid-cpp-client-rdma", "OS": "RedHat", "packageVersion": "0.14-14.el6_2", "operator": "lt"}, {"arch": "src", "packageFilename": "qpid-qmf-0.14-7.el6_2.src.rpm", "OSVersion": "6", "packageName": "qpid-qmf", "OS": "RedHat", "packageVersion": "0.14-7.el6_2", "operator": "lt"}, {"arch": "noarch", "packageFilename": "qpid-java-example-0.14-3.el6.noarch.rpm", "OSVersion": "6", "packageName": "qpid-java-example", "OS": "RedHat", "packageVersion": "0.14-3.el6", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "condor-plumage-7.6.5-0.14.el6.x86_64.rpm", "OSVersion": "6", "packageName": "condor-plumage", "OS": "RedHat", "packageVersion": "7.6.5-0.14.el6", "operator": "lt"}, {"arch": "i686", "packageFilename": "condor-kbdd-7.6.5-0.14.el6.i686.rpm", "OSVersion": "6", "packageName": "condor-kbdd", "OS": "RedHat", "packageVersion": "7.6.5-0.14.el6", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "condor-aviary-7.6.5-0.14.el6.x86_64.rpm", "OSVersion": "6", "packageName": "condor-aviary", "OS": "RedHat", "packageVersion": "7.6.5-0.14.el6", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "qpid-qmf-debuginfo-0.14-7.el6_2.x86_64.rpm", "OSVersion": "6", "packageName": "qpid-qmf-debuginfo", "OS": "RedHat", "packageVersion": "0.14-7.el6_2", "operator": "lt"}, {"arch": "noarch", "packageFilename": "qpid-java-client-0.14-3.el6.noarch.rpm", "OSVersion": "6", "packageName": "qpid-java-client", "OS": "RedHat", "packageVersion": "0.14-3.el6", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "condor-7.6.5-0.14.el6.x86_64.rpm", "OSVersion": "6", "packageName": "condor", "OS": "RedHat", "packageVersion": "7.6.5-0.14.el6", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "sesame-debuginfo-1.0-5.el6.x86_64.rpm", "OSVersion": "6", "packageName": "sesame-debuginfo", "OS": "RedHat", "packageVersion": "1.0-5.el6", "operator": "lt"}, {"arch": "i686", "packageFilename": "qpid-cpp-client-devel-0.14-14.el6_2.i686.rpm", "OSVersion": "6", "packageName": "qpid-cpp-client-devel", "OS": "RedHat", "packageVersion": "0.14-14.el6_2", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "condor-qmf-7.6.5-0.14.el6.x86_64.rpm", "OSVersion": "6", "packageName": "condor-qmf", "OS": "RedHat", "packageVersion": "7.6.5-0.14.el6", "operator": "lt"}, {"arch": "i686", "packageFilename": "condor-7.6.5-0.14.el6.i686.rpm", "OSVersion": "6", "packageName": "condor", "OS": "RedHat", "packageVersion": "7.6.5-0.14.el6", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "qpid-cpp-server-cluster-0.14-14.el6_2.x86_64.rpm", "OSVersion": "6", "packageName": "qpid-cpp-server-cluster", "OS": "RedHat", "packageVersion": "0.14-14.el6_2", "operator": "lt"}, {"arch": "src", "packageFilename": "sesame-1.0-5.el6.src.rpm", "OSVersion": "6", "packageName": "sesame", "OS": "RedHat", "packageVersion": "1.0-5.el6", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "qpid-cpp-server-rdma-0.14-14.el6_2.x86_64.rpm", "OSVersion": "6", "packageName": "qpid-cpp-server-rdma", "OS": "RedHat", "packageVersion": "0.14-14.el6_2", "operator": "lt"}, {"arch": "i686", "packageFilename": "condor-debuginfo-7.6.5-0.14.el6.i686.rpm", "OSVersion": "6", "packageName": "condor-debuginfo", "OS": "RedHat", "packageVersion": "7.6.5-0.14.el6", "operator": "lt"}, {"arch": "i686", "packageFilename": "qpid-cpp-server-cluster-0.14-14.el6_2.i686.rpm", "OSVersion": "6", "packageName": "qpid-cpp-server-cluster", "OS": "RedHat", "packageVersion": "0.14-14.el6_2", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "sesame-1.0-5.el6.x86_64.rpm", "OSVersion": "6", "packageName": "sesame", "OS": "RedHat", "packageVersion": "1.0-5.el6", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "qpid-cpp-server-xml-0.14-14.el6_2.x86_64.rpm", "OSVersion": "6", "packageName": "qpid-cpp-server-xml", "OS": "RedHat", "packageVersion": "0.14-14.el6_2", "operator": "lt"}, {"arch": "i686", "packageFilename": "qpid-cpp-debuginfo-0.14-14.el6_2.i686.rpm", "OSVersion": "6", "packageName": "qpid-cpp-debuginfo", "OS": "RedHat", "packageVersion": "0.14-14.el6_2", "operator": "lt"}, {"arch": "i686", "packageFilename": "condor-classads-7.6.5-0.14.el6.i686.rpm", "OSVersion": "6", "packageName": "condor-classads", "OS": "RedHat", "packageVersion": "7.6.5-0.14.el6", "operator": "lt"}, {"arch": "noarch", "packageFilename": "qpid-jca-xarecovery-0.14-9.el6.noarch.rpm", "OSVersion": "6", "packageName": "qpid-jca-xarecovery", "OS": "RedHat", "packageVersion": "0.14-9.el6", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "qpid-cpp-server-devel-0.14-14.el6_2.x86_64.rpm", "OSVersion": "6", "packageName": "qpid-cpp-server-devel", "OS": "RedHat", "packageVersion": "0.14-14.el6_2", "operator": "lt"}, {"arch": "noarch", "packageFilename": "qpid-cpp-client-devel-docs-0.14-14.el6_2.noarch.rpm", "OSVersion": "6", "packageName": "qpid-cpp-client-devel-docs", "OS": "RedHat", "packageVersion": "0.14-14.el6_2", "operator": "lt"}, {"arch": "i686", "packageFilename": "sesame-debuginfo-1.0-5.el6.i686.rpm", "OSVersion": "6", "packageName": "sesame-debuginfo", "OS": "RedHat", "packageVersion": "1.0-5.el6", "operator": "lt"}, {"arch": "i686", "packageFilename": "condor-aviary-7.6.5-0.14.el6.i686.rpm", "OSVersion": "6", "packageName": "condor-aviary", "OS": "RedHat", "packageVersion": "7.6.5-0.14.el6", "operator": "lt"}, {"arch": "src", "packageFilename": "qpid-cpp-0.14-14.el6_2.src.rpm", "OSVersion": "6", "packageName": "qpid-cpp", "OS": "RedHat", "packageVersion": "0.14-14.el6_2", "operator": "lt"}, {"arch": "i686", "packageFilename": "sesame-1.0-5.el6.i686.rpm", "OSVersion": "6", "packageName": "sesame", "OS": "RedHat", "packageVersion": "1.0-5.el6", "operator": "lt"}, {"arch": "i686", "packageFilename": "condor-qmf-7.6.5-0.14.el6.i686.rpm", "OSVersion": "6", "packageName": "condor-qmf", "OS": "RedHat", "packageVersion": "7.6.5-0.14.el6", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "qpid-cpp-server-store-0.14-14.el6_2.x86_64.rpm", "OSVersion": "6", "packageName": "qpid-cpp-server-store", "OS": "RedHat", "packageVersion": "0.14-14.el6_2", "operator": "lt"}, {"arch": "i686", "packageFilename": "qpid-qmf-devel-0.14-7.el6_2.i686.rpm", "OSVersion": "6", "packageName": "qpid-qmf-devel", "OS": "RedHat", "packageVersion": "0.14-7.el6_2", "operator": "lt"}, {"arch": "i686", "packageFilename": "qpid-cpp-server-devel-0.14-14.el6_2.i686.rpm", "OSVersion": "6", "packageName": "qpid-cpp-server-devel", "OS": "RedHat", "packageVersion": "0.14-14.el6_2", "operator": "lt"}, {"arch": "i686", "packageFilename": "qpid-qmf-debuginfo-0.14-7.el6_2.i686.rpm", "OSVersion": "6", "packageName": "qpid-qmf-debuginfo", "OS": "RedHat", "packageVersion": "0.14-7.el6_2", "operator": "lt"}, {"arch": "i686", "packageFilename": "qpid-cpp-server-store-0.14-14.el6_2.i686.rpm", "OSVersion": "6", "packageName": "qpid-cpp-server-store", "OS": "RedHat", "packageVersion": "0.14-14.el6_2", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "qpid-qmf-devel-0.14-7.el6_2.x86_64.rpm", "OSVersion": "6", "packageName": "qpid-qmf-devel", "OS": "RedHat", "packageVersion": "0.14-7.el6_2", "operator": "lt"}, {"arch": "x86_64", "packageFilename": "qpid-cpp-client-devel-0.14-14.el6_2.x86_64.rpm", "OSVersion": "6", "packageName": "qpid-cpp-client-devel", "OS": "RedHat", "packageVersion": "0.14-14.el6_2", "operator": "lt"}, {"arch": "i686", "packageFilename": "qpid-cpp-server-rdma-0.14-14.el6_2.i686.rpm", "OSVersion": "6", "packageName": "qpid-cpp-server-rdma", "OS": "RedHat", "packageVersion": "0.14-14.el6_2", "operator": "lt"}, {"arch": "noarch", "packageFilename": "qpid-jca-0.14-9.el6.noarch.rpm", "OSVersion": "6", "packageName": "qpid-jca", "OS": "RedHat", "packageVersion": "0.14-9.el6", "operator": "lt"}]}, "lastseen": "2017-03-03T19:18:28", "differentElements": ["modified"], "edition": 1}, {"bulletin": {"id": "RHSA-2012:0528", "hash": "2b360e649d98f09b3f64ffcba49b4967", "type": "redhat", "bulletinFamily": "unix", "title": "(RHSA-2012:0528) Moderate: Red Hat Enterprise MRG Messaging 2.1 security and enhancement update", "description": "Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a next-generation\nIT infrastructure for enterprise computing. MRG offers increased\nperformance, reliability, interoperability, and faster computing for\nenterprise customers.\n\nMRG Messaging is a high-speed reliable messaging distribution for Linux\nbased on AMQP (Advanced Message Queuing Protocol), an open protocol\nstandard for enterprise messaging that is designed to make mission critical\nmessaging widely available as a standard service, and to make enterprise\nmessaging interoperable across platforms, programming languages, and\nvendors. MRG Messaging includes an AMQP 0-10 messaging broker; AMQP 0-10\nclient libraries for C++, Java JMS, and Python; as well as persistence\nlibraries and management tools.\n\nIt was found that Qpid accepted any password or SASL mechanism, provided\nthe remote user knew a valid cluster username. This could give a remote\nattacker unauthorized access to the cluster, exposing cluster messages and\ninternal Qpid/MRG configurations. (CVE-2011-3620)\n\nNote: If you are using an ACL, the cluster-username must be allowed to\npublish to the qpid.cluster-credentials exchange. For example, if your\ncluster-username is \"foo\", in your ACL file:\n\nacl allow foo@QPID publish exchange name=qpid.cluster-credentials\n\nThe CVE-2011-3620 fix changes the cluster initialization protocol. As such,\nthe cluster with all new version brokers must be restarted for the changes\nto take effect. Refer below for details.\n\nThese updated packages provide numerous enhancements and bug fixes for the\nMessaging component of MRG. Space precludes documenting all of these\nchanges in this advisory. Documentation for these changes will be available\nshortly in the Technical Notes document linked to in the References\nsection.\n\nAll users of the Messaging capabilities of Red Hat Enterprise MRG 2.1 are\nadvised to upgrade to these updated packages, which resolve the issues and\nadd the enhancements noted in the Red Hat Enterprise MRG 2 Technical Notes.\nAfter installing the updated packages, stop the cluster by either running\n\"service qpidd stop\" on all nodes, or \"qpid-cluster --all-stop\" on any one\nof the cluster nodes. Once stopped, restart the cluster with\n\"service qpidd start\" on all nodes for the update to take effect.\n", "published": "2012-04-30T04:00:00", "modified": "2018-06-07T02:47:19", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://access.redhat.com/errata/RHSA-2012:0528", "reporter": "RedHat", "references": [], "cvelist": ["CVE-2011-3620"], "lastseen": "2018-06-06T23:50:53", "history": [], "viewCount": 4, "enchantments": {"score": {"value": 5.0, "vector": "NONE"}}, "objectVersion": "1.4", "affectedPackage": [{"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "condor-debuginfo", "packageVersion": "7.6.5-0.14.el6", "packageFilename": "condor-debuginfo-7.6.5-0.14.el6.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "src", "packageName": "condor", "packageVersion": "7.6.5-0.14.el6", "packageFilename": "condor-7.6.5-0.14.el6.src.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "condor", "packageVersion": "7.6.5-0.14.el6", "packageFilename": "condor-7.6.5-0.14.el6.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "condor-classads", "packageVersion": "7.6.5-0.14.el6", "packageFilename": "condor-classads-7.6.5-0.14.el6.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "condor-vm-gahp", "packageVersion": "7.6.5-0.14.el6", "packageFilename": "condor-vm-gahp-7.6.5-0.14.el6.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "condor-kbdd", "packageVersion": "7.6.5-0.14.el6", "packageFilename": "condor-kbdd-7.6.5-0.14.el6.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "condor-qmf", "packageVersion": "7.6.5-0.14.el6", "packageFilename": "condor-qmf-7.6.5-0.14.el6.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "sesame-debuginfo", "packageVersion": "1.0-5.el6", "packageFilename": "sesame-debuginfo-1.0-5.el6.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "src", "packageName": "sesame", "packageVersion": "1.0-5.el6", "packageFilename": "sesame-1.0-5.el6.src.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "sesame", "packageVersion": "1.0-5.el6", "packageFilename": "sesame-1.0-5.el6.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "condor-debuginfo", "packageVersion": "7.6.5-0.14.el6", "packageFilename": "condor-debuginfo-7.6.5-0.14.el6.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "sesame-debuginfo", "packageVersion": "1.0-5.el6", "packageFilename": "sesame-debuginfo-1.0-5.el6.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "condor", "packageVersion": "7.6.5-0.14.el6", "packageFilename": "condor-7.6.5-0.14.el6.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "condor-kbdd", "packageVersion": "7.6.5-0.14.el6", "packageFilename": "condor-kbdd-7.6.5-0.14.el6.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "condor-classads", "packageVersion": "7.6.5-0.14.el6", "packageFilename": "condor-classads-7.6.5-0.14.el6.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "condor-qmf", "packageVersion": "7.6.5-0.14.el6", "packageFilename": "condor-qmf-7.6.5-0.14.el6.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "condor-aviary", "packageVersion": "7.6.5-0.14.el6", "packageFilename": "condor-aviary-7.6.5-0.14.el6.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "condor-plumage", "packageVersion": "7.6.5-0.14.el6", "packageFilename": "condor-plumage-7.6.5-0.14.el6.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "sesame", "packageVersion": "1.0-5.el6", "packageFilename": "sesame-1.0-5.el6.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "condor-aviary", "packageVersion": "7.6.5-0.14.el6", "packageFilename": "condor-aviary-7.6.5-0.14.el6.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "condor-plumage", "packageVersion": "7.6.5-0.14.el6", "packageFilename": "condor-plumage-7.6.5-0.14.el6.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "qpid-cpp-debuginfo", "packageVersion": "0.14-14.el6_2", "packageFilename": "qpid-cpp-debuginfo-0.14-14.el6_2.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "qpid-qmf-debuginfo", "packageVersion": "0.14-7.el6_2", "packageFilename": "qpid-qmf-debuginfo-0.14-7.el6_2.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "src", "packageName": "qpid-cpp", "packageVersion": "0.14-14.el6_2", "packageFilename": "qpid-cpp-0.14-14.el6_2.src.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "src", "packageName": "qpid-qmf", "packageVersion": "0.14-7.el6_2", "packageFilename": "qpid-qmf-0.14-7.el6_2.src.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "qpid-cpp-debuginfo", "packageVersion": "0.14-14.el6_2", "packageFilename": "qpid-cpp-debuginfo-0.14-14.el6_2.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "qpid-qmf-debuginfo", "packageVersion": "0.14-7.el6_2", "packageFilename": "qpid-qmf-debuginfo-0.14-7.el6_2.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "qpid-cpp-server-rdma", "packageVersion": "0.14-14.el6_2", "packageFilename": "qpid-cpp-server-rdma-0.14-14.el6_2.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "qpid-cpp-server-store", "packageVersion": "0.14-14.el6_2", "packageFilename": "qpid-cpp-server-store-0.14-14.el6_2.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "qpid-cpp-server-xml", "packageVersion": "0.14-14.el6_2", "packageFilename": "qpid-cpp-server-xml-0.14-14.el6_2.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "qpid-cpp-client-devel", "packageVersion": "0.14-14.el6_2", "packageFilename": "qpid-cpp-client-devel-0.14-14.el6_2.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "qpid-cpp-client-rdma", "packageVersion": "0.14-14.el6_2", "packageFilename": "qpid-cpp-client-rdma-0.14-14.el6_2.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "qpid-cpp-server-cluster", "packageVersion": "0.14-14.el6_2", "packageFilename": "qpid-cpp-server-cluster-0.14-14.el6_2.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "qpid-cpp-server-devel", "packageVersion": "0.14-14.el6_2", "packageFilename": "qpid-cpp-server-devel-0.14-14.el6_2.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "noarch", "packageName": "qpid-cpp-client-devel-docs", "packageVersion": "0.14-14.el6_2", "packageFilename": "qpid-cpp-client-devel-docs-0.14-14.el6_2.noarch.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "noarch", "packageName": "qpid-java-example", "packageVersion": "0.14-3.el6", "packageFilename": "qpid-java-example-0.14-3.el6.noarch.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "noarch", "packageName": "qpid-java-client", "packageVersion": "0.14-3.el6", "packageFilename": "qpid-java-client-0.14-3.el6.noarch.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "noarch", "packageName": "qpid-java-common", "packageVersion": "0.14-3.el6", "packageFilename": "qpid-java-common-0.14-3.el6.noarch.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "noarch", "packageName": "qpid-jca", "packageVersion": "0.14-9.el6", "packageFilename": "qpid-jca-0.14-9.el6.noarch.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "noarch", "packageName": "qpid-jca-xarecovery", "packageVersion": "0.14-9.el6", "packageFilename": "qpid-jca-xarecovery-0.14-9.el6.noarch.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "i686", "packageName": "qpid-qmf-devel", "packageVersion": "0.14-7.el6_2", "packageFilename": "qpid-qmf-devel-0.14-7.el6_2.i686.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "src", "packageName": "qpid-java", "packageVersion": "0.14-3.el6", "packageFilename": "qpid-java-0.14-3.el6.src.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "src", "packageName": "qpid-jca", "packageVersion": "0.14-9.el6", "packageFilename": "qpid-jca-0.14-9.el6.src.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "qpid-cpp-client-devel", "packageVersion": "0.14-14.el6_2", "packageFilename": "qpid-cpp-client-devel-0.14-14.el6_2.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "qpid-cpp-client-rdma", "packageVersion": "0.14-14.el6_2", "packageFilename": "qpid-cpp-client-rdma-0.14-14.el6_2.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "qpid-cpp-server-cluster", "packageVersion": "0.14-14.el6_2", "packageFilename": "qpid-cpp-server-cluster-0.14-14.el6_2.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "qpid-cpp-server-devel", "packageVersion": "0.14-14.el6_2", "packageFilename": "qpid-cpp-server-devel-0.14-14.el6_2.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "qpid-cpp-server-rdma", "packageVersion": "0.14-14.el6_2", "packageFilename": "qpid-cpp-server-rdma-0.14-14.el6_2.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "qpid-cpp-server-store", "packageVersion": "0.14-14.el6_2", "packageFilename": "qpid-cpp-server-store-0.14-14.el6_2.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "qpid-qmf-devel", "packageVersion": "0.14-7.el6_2", "packageFilename": "qpid-qmf-devel-0.14-7.el6_2.x86_64.rpm", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "qpid-cpp-server-xml", "packageVersion": "0.14-14.el6_2", "packageFilename": "qpid-cpp-server-xml-0.14-14.el6_2.x86_64.rpm", "operator": "lt"}]}, "lastseen": "2018-06-06T23:50:53", "differentElements": ["affectedPackage"], "edition": 2}], "viewCount": 4, "enchantments": {"score": {"value": 5.0, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2011-3620"]}, {"type": "redhat", "idList": ["RHSA-2012:0529"]}, {"type": "seebug", "idList": ["SSV:60090"]}, {"type": "nessus", "idList": ["REDHAT-RHSA-2012-0529.NASL", "REDHAT-RHSA-2012-0528.NASL"]}], "modified": "2018-12-11T19:40:59"}, "vulnersScore": 5.0}, "objectVersion": "1.4", "affectedPackage": [{"OS": "RedHat", "OSVersion": "6", "arch": "x86_64", "packageName": "condor-debuginfo", "packageVersion": "7.6.5-0.14.el6", "packageFilename": "condor-debuginfo-7.6.5-0.14.el6.x86_64.rpm", "operator": "lt"}], "_object_type": "robots.models.redhat.RedHatBulletin", "_object_types": ["robots.models.base.Bulletin", "robots.models.redhat.RedHatBulletin"]}

{"cve": [{"lastseen": "2016-09-03T15:43:02", "bulletinFamily": "NVD", "description": "Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster, which allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by leveraging knowledge of a cluster-username.", "modified": "2012-08-13T23:30:29", "published": "2012-05-03T19:55:01", "id": "CVE-2011-3620", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3620", "type": "cve", "title": "CVE-2011-3620", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "nessus": [{"lastseen": "2019-01-16T20:19:23", "bulletinFamily": "scanner", "description": "Updated Messaging packages that resolve one security issue, fix\nmultiple bugs, and add various enhancements are now available for Red\nHat Enterprise MRG 2.1 for Red Hat Enterprise Linux 5.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from\nthe CVE link in the References section.\n\nRed Hat Enterprise MRG (Messaging, Realtime, and Grid) is a\nnext-generation IT infrastructure for enterprise computing. MRG offers\nincreased performance, reliability, interoperability, and faster\ncomputing for enterprise customers.\n\nMRG Messaging is a high-speed reliable messaging distribution for\nLinux based on AMQP (Advanced Message Queuing Protocol), an open\nprotocol standard for enterprise messaging that is designed to make\nmission critical messaging widely available as a standard service, and\nto make enterprise messaging interoperable across platforms,\nprogramming languages, and vendors. MRG Messaging includes an AMQP\n0-10 messaging broker; AMQP 0-10 client libraries for C++, Java JMS,\nand Python; as well as persistence libraries and management tools.\n\nIt was found that Qpid accepted any password or SASL mechanism,\nprovided the remote user knew a valid cluster username. This could\ngive a remote attacker unauthorized access to the cluster, exposing\ncluster messages and internal Qpid/MRG configurations. (CVE-2011-3620)\n\nNote: If you are using an ACL, the cluster-username must be allowed to\npublish to the qpid.cluster-credentials exchange. For example, if your\ncluster-username is 'foo', in your ACL file :\n\nacl allow foo@QPID publish exchange name=qpid.cluster-credentials\n\nThe CVE-2011-3620 fix changes the cluster initialization protocol. As\nsuch, the cluster with all new version brokers must be restarted for\nthe changes to take effect. Refer below for details.\n\nThese updated packages provide numerous enhancements and bug fixes for\nthe Messaging component of MRG. Space precludes documenting all of\nthese changes in this advisory. Documentation for these changes will\nbe available shortly in the Technical Notes document linked to in the\nReferences section.\n\nAll users of the Messaging capabilities of Red Hat Enterprise MRG 2.1\nare advised to upgrade to these updated packages, which resolve the\nissues and add the enhancements noted in the Red Hat Enterprise MRG 2\nTechnical Notes. After installing the updated packages, stop the\ncluster by either running 'service qpidd stop' on all nodes, or\n'qpid-cluster --all-stop' on any one of the cluster nodes. Once\nstopped, restart the cluster with 'service qpidd start' on all nodes\nfor the update to take effect.", "modified": "2018-11-10T00:00:00", "published": "2014-07-22T00:00:00", "id": "REDHAT-RHSA-2012-0529.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=76643", "title": "RHEL 5 : MRG (RHSA-2012:0529)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2012:0529. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(76643);\n script_version(\"1.6\");\n script_cvs_date(\"Date: 2018/11/10 11:49:52\");\n\n script_cve_id(\"CVE-2011-3620\");\n script_xref(name:\"RHSA\", value:\"2012:0529\");\n\n script_name(english:\"RHEL 5 : MRG (RHSA-2012:0529)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated Messaging packages that resolve one security issue, fix\nmultiple bugs, and add various enhancements are now available for Red\nHat Enterprise MRG 2.1 for Red Hat Enterprise Linux 5.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from\nthe CVE link in the References section.\n\nRed Hat Enterprise MRG (Messaging, Realtime, and Grid) is a\nnext-generation IT infrastructure for enterprise computing. MRG offers\nincreased performance, reliability, interoperability, and faster\ncomputing for enterprise customers.\n\nMRG Messaging is a high-speed reliable messaging distribution for\nLinux based on AMQP (Advanced Message Queuing Protocol), an open\nprotocol standard for enterprise messaging that is designed to make\nmission critical messaging widely available as a standard service, and\nto make enterprise messaging interoperable across platforms,\nprogramming languages, and vendors. MRG Messaging includes an AMQP\n0-10 messaging broker; AMQP 0-10 client libraries for C++, Java JMS,\nand Python; as well as persistence libraries and management tools.\n\nIt was found that Qpid accepted any password or SASL mechanism,\nprovided the remote user knew a valid cluster username. This could\ngive a remote attacker unauthorized access to the cluster, exposing\ncluster messages and internal Qpid/MRG configurations. (CVE-2011-3620)\n\nNote: If you are using an ACL, the cluster-username must be allowed to\npublish to the qpid.cluster-credentials exchange. For example, if your\ncluster-username is 'foo', in your ACL file :\n\nacl allow foo@QPID publish exchange name=qpid.cluster-credentials\n\nThe CVE-2011-3620 fix changes the cluster initialization protocol. As\nsuch, the cluster with all new version brokers must be restarted for\nthe changes to take effect. Refer below for details.\n\nThese updated packages provide numerous enhancements and bug fixes for\nthe Messaging component of MRG. Space precludes documenting all of\nthese changes in this advisory. Documentation for these changes will\nbe available shortly in the Technical Notes document linked to in the\nReferences section.\n\nAll users of the Messaging capabilities of Red Hat Enterprise MRG 2.1\nare advised to upgrade to these updated packages, which resolve the\nissues and add the enhancements noted in the Red Hat Enterprise MRG 2\nTechnical Notes. After installing the updated packages, stop the\ncluster by either running 'service qpidd stop' on all nodes, or\n'qpid-cluster --all-stop' on any one of the cluster nodes. Once\nstopped, restart the cluster with 'service qpidd start' on all nodes\nfor the update to take effect.\"\n );\n # http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_MRG/2/html-single/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?5155268e\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2012:0529\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2011-3620\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:condor\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:condor-aviary\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:condor-classads\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:condor-kbdd\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:condor-qmf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:condor-vm-gahp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:sesame\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/04/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/07/22\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = eregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^5([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 5.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2012:0529\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n\n if (! (rpm_exists(release:\"RHEL5\", rpm:\"mrg-release\"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, \"MRG\");\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"condor-7.6.5-0.14.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"condor-7.6.5-0.14.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"condor-aviary-7.6.5-0.14.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"condor-aviary-7.6.5-0.14.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"condor-classads-7.6.5-0.14.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"condor-classads-7.6.5-0.14.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"condor-kbdd-7.6.5-0.14.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"condor-kbdd-7.6.5-0.14.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"condor-qmf-7.6.5-0.14.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"condor-qmf-7.6.5-0.14.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"condor-vm-gahp-7.6.5-0.14.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"condor-vm-gahp-7.6.5-0.14.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"sesame-1.0-3.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"sesame-1.0-3.el5\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"condor / condor-aviary / condor-classads / condor-kbdd / condor-qmf / etc\");\n }\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-01-16T20:19:23", "bulletinFamily": "scanner", "description": "Updated Messaging packages that resolve one security issue, fix\nmultiple bugs, and add various enhancements are now available for Red\nHat Enterprise MRG 2.1 for Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from\nthe CVE link in the References section.\n\nRed Hat Enterprise MRG (Messaging, Realtime, and Grid) is a\nnext-generation IT infrastructure for enterprise computing. MRG offers\nincreased performance, reliability, interoperability, and faster\ncomputing for enterprise customers.\n\nMRG Messaging is a high-speed reliable messaging distribution for\nLinux based on AMQP (Advanced Message Queuing Protocol), an open\nprotocol standard for enterprise messaging that is designed to make\nmission critical messaging widely available as a standard service, and\nto make enterprise messaging interoperable across platforms,\nprogramming languages, and vendors. MRG Messaging includes an AMQP\n0-10 messaging broker; AMQP 0-10 client libraries for C++, Java JMS,\nand Python; as well as persistence libraries and management tools.\n\nIt was found that Qpid accepted any password or SASL mechanism,\nprovided the remote user knew a valid cluster username. This could\ngive a remote attacker unauthorized access to the cluster, exposing\ncluster messages and internal Qpid/MRG configurations. (CVE-2011-3620)\n\nNote: If you are using an ACL, the cluster-username must be allowed to\npublish to the qpid.cluster-credentials exchange. For example, if your\ncluster-username is 'foo', in your ACL file :\n\nacl allow foo@QPID publish exchange name=qpid.cluster-credentials\n\nThe CVE-2011-3620 fix changes the cluster initialization protocol. As\nsuch, the cluster with all new version brokers must be restarted for\nthe changes to take effect. Refer below for details.\n\nThese updated packages provide numerous enhancements and bug fixes for\nthe Messaging component of MRG. Space precludes documenting all of\nthese changes in this advisory. Documentation for these changes will\nbe available shortly in the Technical Notes document linked to in the\nReferences section.\n\nAll users of the Messaging capabilities of Red Hat Enterprise MRG 2.1\nare advised to upgrade to these updated packages, which resolve the\nissues and add the enhancements noted in the Red Hat Enterprise MRG 2\nTechnical Notes. After installing the updated packages, stop the\ncluster by either running 'service qpidd stop' on all nodes, or\n'qpid-cluster --all-stop' on any one of the cluster nodes. Once\nstopped, restart the cluster with 'service qpidd start' on all nodes\nfor the update to take effect.", "modified": "2018-11-10T00:00:00", "published": "2014-07-22T00:00:00", "id": "REDHAT-RHSA-2012-0528.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=76642", "title": "RHEL 6 : MRG (RHSA-2012:0528)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2012:0528. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(76642);\n script_version(\"1.6\");\n script_cvs_date(\"Date: 2018/11/10 11:49:52\");\n\n script_cve_id(\"CVE-2011-3620\");\n script_xref(name:\"RHSA\", value:\"2012:0528\");\n\n script_name(english:\"RHEL 6 : MRG (RHSA-2012:0528)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated Messaging packages that resolve one security issue, fix\nmultiple bugs, and add various enhancements are now available for Red\nHat Enterprise MRG 2.1 for Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from\nthe CVE link in the References section.\n\nRed Hat Enterprise MRG (Messaging, Realtime, and Grid) is a\nnext-generation IT infrastructure for enterprise computing. MRG offers\nincreased performance, reliability, interoperability, and faster\ncomputing for enterprise customers.\n\nMRG Messaging is a high-speed reliable messaging distribution for\nLinux based on AMQP (Advanced Message Queuing Protocol), an open\nprotocol standard for enterprise messaging that is designed to make\nmission critical messaging widely available as a standard service, and\nto make enterprise messaging interoperable across platforms,\nprogramming languages, and vendors. MRG Messaging includes an AMQP\n0-10 messaging broker; AMQP 0-10 client libraries for C++, Java JMS,\nand Python; as well as persistence libraries and management tools.\n\nIt was found that Qpid accepted any password or SASL mechanism,\nprovided the remote user knew a valid cluster username. This could\ngive a remote attacker unauthorized access to the cluster, exposing\ncluster messages and internal Qpid/MRG configurations. (CVE-2011-3620)\n\nNote: If you are using an ACL, the cluster-username must be allowed to\npublish to the qpid.cluster-credentials exchange. For example, if your\ncluster-username is 'foo', in your ACL file :\n\nacl allow foo@QPID publish exchange name=qpid.cluster-credentials\n\nThe CVE-2011-3620 fix changes the cluster initialization protocol. As\nsuch, the cluster with all new version brokers must be restarted for\nthe changes to take effect. Refer below for details.\n\nThese updated packages provide numerous enhancements and bug fixes for\nthe Messaging component of MRG. Space precludes documenting all of\nthese changes in this advisory. Documentation for these changes will\nbe available shortly in the Technical Notes document linked to in the\nReferences section.\n\nAll users of the Messaging capabilities of Red Hat Enterprise MRG 2.1\nare advised to upgrade to these updated packages, which resolve the\nissues and add the enhancements noted in the Red Hat Enterprise MRG 2\nTechnical Notes. After installing the updated packages, stop the\ncluster by either running 'service qpidd stop' on all nodes, or\n'qpid-cluster --all-stop' on any one of the cluster nodes. Once\nstopped, restart the cluster with 'service qpidd start' on all nodes\nfor the update to take effect.\"\n );\n # http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_MRG/2/html-single/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?5155268e\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2012:0528\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2011-3620\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:condor\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:condor-aviary\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:condor-classads\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:condor-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:condor-kbdd\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:condor-plumage\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:condor-qmf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:condor-vm-gahp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:sesame\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:sesame-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/04/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/07/22\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = eregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2012:0528\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n\n if (! (rpm_exists(release:\"RHEL6\", rpm:\"mrg-release\"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, \"MRG\");\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"condor-7.6.5-0.14.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"condor-7.6.5-0.14.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"condor-aviary-7.6.5-0.14.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"condor-aviary-7.6.5-0.14.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"condor-classads-7.6.5-0.14.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"condor-classads-7.6.5-0.14.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"condor-debuginfo-7.6.5-0.14.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"condor-debuginfo-7.6.5-0.14.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"condor-kbdd-7.6.5-0.14.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"condor-kbdd-7.6.5-0.14.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"condor-plumage-7.6.5-0.14.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"condor-plumage-7.6.5-0.14.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"condor-qmf-7.6.5-0.14.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"condor-qmf-7.6.5-0.14.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"condor-vm-gahp-7.6.5-0.14.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"sesame-1.0-5.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"sesame-1.0-5.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"sesame-debuginfo-1.0-5.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"sesame-debuginfo-1.0-5.el6\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"condor / condor-aviary / condor-classads / condor-debuginfo / etc\");\n }\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "seebug": [{"lastseen": "2017-11-19T17:57:42", "bulletinFamily": "exploit", "description": "BUGTRAQ ID: 53305\r\nCVE ID: CVE-2011-3620\r\n\r\nApache Qpid\uff08Open Source AMQP Messaging\uff09\u662f\u4e00\u4e2a\u8de8\u5e73\u53f0\u7684\u4f01\u4e1a\u901a\u8baf\u89e3\u51b3\u65b9\u6848\uff0c\u5b9e\u73b0\u4e86\u9ad8\u7ea7\u6d88\u606f\u961f\u5217\u534f\u8bae\u3002\r\n\r\nApache Qpid 0.12\u5728\u901a\u8fc7\u7fa4\u96c6\u7528\u6237\u540d\u8fde\u63a5\u7fa4\u96c6\u65f6\u6ca1\u6709\u9a8c\u8bc1SASL\u8bc1\u4e66\u7684\u5bc6\u7801\uff0c\u53ef\u901a\u8fc7\u6076\u610f\u7684\u4ee3\u7406\u975e\u6cd5\u8bbf\u95ee\u7fa4\u96c6\u3002\n0\nApache Group Qpid 0.x\n\u5382\u5546\u8865\u4e01\uff1a\r\n\r\nApache Group\r\n------------\r\n\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\n\r\nhttp://httpd.apache.org/", "modified": "2012-05-03T00:00:00", "published": "2012-05-03T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-60090", "id": "SSV:60090", "title": "Apache Qpid\u975e\u6cd5\u8bbf\u95ee\u5b89\u5168\u9650\u5236\u7ed5\u8fc7\u6f0f\u6d1e", "type": "seebug", "sourceData": "", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": ""}], "redhat": [{"lastseen": "2018-12-11T17:41:36", "bulletinFamily": "unix", "description": "Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a next-generation\nIT infrastructure for enterprise computing. MRG offers increased\nperformance, reliability, interoperability, and faster computing for\nenterprise customers.\n\nMRG Messaging is a high-speed reliable messaging distribution for Linux\nbased on AMQP (Advanced Message Queuing Protocol), an open protocol\nstandard for enterprise messaging that is designed to make mission critical\nmessaging widely available as a standard service, and to make enterprise\nmessaging interoperable across platforms, programming languages, and\nvendors. MRG Messaging includes an AMQP 0-10 messaging broker; AMQP 0-10\nclient libraries for C++, Java JMS, and Python; as well as persistence\nlibraries and management tools.\n\nIt was found that Qpid accepted any password or SASL mechanism, provided\nthe remote user knew a valid cluster username. This could give a remote\nattacker unauthorized access to the cluster, exposing cluster messages and\ninternal Qpid/MRG configurations. (CVE-2011-3620)\n\nNote: If you are using an ACL, the cluster-username must be allowed to\npublish to the qpid.cluster-credentials exchange. For example, if your\ncluster-username is \"foo\", in your ACL file:\n\nacl allow foo@QPID publish exchange name=qpid.cluster-credentials\n\nThe CVE-2011-3620 fix changes the cluster initialization protocol. As such,\nthe cluster with all new version brokers must be restarted for the changes\nto take effect. Refer below for details.\n\nThese updated packages provide numerous enhancements and bug fixes for the\nMessaging component of MRG. Space precludes documenting all of these\nchanges in this advisory. Documentation for these changes will be available\nshortly in the Technical Notes document linked to in the References\nsection.\n\nAll users of the Messaging capabilities of Red Hat Enterprise MRG 2.1 are\nadvised to upgrade to these updated packages, which resolve the issues and\nadd the enhancements noted in the Red Hat Enterprise MRG 2 Technical Notes.\nAfter installing the updated packages, stop the cluster by either running\n\"service qpidd stop\" on all nodes, or \"qpid-cluster --all-stop\" on any one\nof the cluster nodes. Once stopped, restart the cluster with\n\"service qpidd start\" on all nodes for the update to take effect.\n", "modified": "2016-04-04T18:34:04", "published": "2012-04-30T04:00:00", "id": "RHSA-2012:0529", "href": "https://access.redhat.com/errata/RHSA-2012:0529", "type": "redhat", "title": "(RHSA-2012:0529) Moderate: Red Hat Enterprise MRG Messaging 2.1 security and enhancement update", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}